You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2020/12/02 12:55:01 UTC
[jira] [Commented] (AMQ-7492) Upgrade to Apache Camel 2.25.2
[ https://issues.apache.org/jira/browse/AMQ-7492?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17242338#comment-17242338 ]
ASF subversion and git services commented on AMQ-7492:
------------------------------------------------------
Commit e1b581acb681ba4dcbd2edd31e94aca0085d91c9 in activemq's branch refs/heads/master from jbonofre
[ https://gitbox.apache.org/repos/asf?p=activemq.git;h=e1b581a ]
[AMQ-7492] Upgrade to Camel 2.25.2
> Upgrade to Apache Camel 2.25.2
> ------------------------------
>
> Key: AMQ-7492
> URL: https://issues.apache.org/jira/browse/AMQ-7492
> Project: ActiveMQ
> Issue Type: Bug
> Components: AMQP
> Affects Versions: 5.15.13
> Reporter: Abhijit Rajwade
> Assignee: Jean-Baptiste Onofré
> Priority: Major
> Labels: security
> Fix For: 5.17.0, 5.16.1, 5.15.14
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
> Refer
> https://www.openwall.com/lists/oss-security/2020/05/14/7 and
> https://github.com/apache/camel/pull/3692
> Can you please upgrade Apache ActiveMQ to use non vlnerable Apache Camel 3.2.0?
> Following is the information from Sonatype Nexus Audior reported issue on AMQ 5.15.13
> Description :
> Severity : CVE CVSS 3: 7.5Sonatype CVSS 3: 7.5
> Weakness : CVE CWE: 20
> Source : National Vulnerability Database
> Categories : Data
> Description from CVE : Apache Camels JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
> Explanation : This issue has undergone the Sonatype Fast-Track process. For more information, please see the Sonatype Knowledge Base Guide.
> Advisories : Project: https://github.com/apache/camel/pull/3692
> CVSS Details : CVE CVSS 3: 7.5CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
> CVE : CVE-2020-11971
> URL : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11971
> Remediation : This component does not have any non-vulnerable Version. Please contact the vendor to get this vulnerability fixed.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)