[jira] [Closed] (TOMEE-4223) TomEE Plume - CVE

["Richard Zowalla (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TOMEE-4223?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Zowalla closed TOMEE-4223.
----------------------------------
      Assignee: Richard Zowalla
    Resolution: Not A Problem

* CVE-2020-8022 -> This is is a SUSE Linux issue due to repackaging of Tomcat, see https://lists.apache.org/thread/hzjyrn0jk0j32t64pc1mlmd67ftqv1c9 
* CVE-2022-4742 -> This is unrelated to Johnzon, see https://nvd.nist.gov/vuln/detail/CVE-2022-4742



> TomEE Plume - CVE
> -----------------
>
>                 Key: TOMEE-4223
>                 URL: https://issues.apache.org/jira/browse/TOMEE-4223
>             Project: TomEE
>          Issue Type: Dependency upgrade
>          Components: TomEE Core Server
>    Affects Versions: 8.0.14
>            Reporter: Swarnaraja
>            Assignee: Richard Zowalla
>            Priority: Minor
>
> Hi Team,
> We are seeing the below CVEs reported against the TomEE (Plume Flavor). Could you please check and confirm if these requires a fix or just false positives ?
>  * *CVE-2022-4742* (CVSS : 9.8)
>  ** Reported against :
>  *** /tomee/lib/johnzon-jsonp-strict-1.2.19.jar
>  ** cpe:2.3:a:json-pointer_project:json-pointer:1.2.19:{*}:{*}:{*}:{*}:{*}:{*}:*
>  * *CVE-2020-8022* (CVSS : 7.8)
>  ** Reported against :
>  *** /tomee/lib/el-api.jar
>  *** /tomee/lib/servlet-api.jar
>  ** cpe:2.3:a:apache:tomcat:3.0:{*}:{*}:{*}:{*}:{*}:{*}:{*};{*} cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.71:::::::
>  
> Thanks



--
This message was sent by Atlassian Jira
(v8.20.10#820010)