You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tomee.apache.org by "Jayaprakash (Jira)" <ji...@apache.org> on 2021/07/05 06:41:00 UTC
[jira] [Updated] (TOMEE-3768) TomEE plus is affected by
CVE-CVE-2021-30468 vulnerability related to Apache CXF
[ https://issues.apache.org/jira/browse/TOMEE-3768?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jayaprakash updated TOMEE-3768:
-------------------------------
Fix Version/s: (was: 8.0.7)
> TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
> --------------------------------------------------------------------------------
>
> Key: TOMEE-3768
> URL: https://issues.apache.org/jira/browse/TOMEE-3768
> Project: TomEE
> Issue Type: Bug
> Affects Versions: 8.0.6
> Reporter: Jayaprakash
> Priority: Major
> Fix For: 8.0.8
>
>
> *Issue:*
> This vulnerability is caused by JsonMapObjectReaderWriter.class of cxf-rt-rs-json-basic.jar. When a malformed JSON is submitted to a web service, it results in thread getting stuck in an infinite loop, consuming CPU indefinitely.
> This is resolved from Apache CXF 3.3.11 or later.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)