[
https://issues.apache.org/jira/browse/ARTEMIS-2363?focusedWorklogId=267945&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-267945
]
ASF GitHub Bot logged work on ARTEMIS-2363:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 26/Jun/19 19:56
Start Date: 26/Jun/19 19:56
Worklog Time Spent: 10m
Work Description: jbertram commented on pull request #2735: ARTEMIS-2363
upgrade Spring dependency
URL: https://github.com/apache/activemq-artemis/pull/2735
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 267945)
Time Spent: 10m
Remaining Estimate: 1h 50m (was: 2h)
> spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756
> ----------------------------------------------------------
>
> Key: ARTEMIS-2363
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2363
> Project: ActiveMQ Artemis
> Issue Type: Wish
> Components: Broker
> Affects Versions: 2.8.1
> Reporter: Albert Baker
> Priority: Minor
> Labels: build, easyfix, security
> Original Estimate: 2h
> Time Spent: 10m
> Remaining Estimate: 1h 50m
>
> Please upgrade the vulnerabile third party libraies that are used with Apache
> ActiveMQ Artimis
> Dependency CPE
> Highest Severity CVE Count CPE Confidence
> ----------------------------------|----------------------------------------------|--------------------|---------------|-----------------------
> spring-core-5.0.1.RELEASE.jar
> cpe:/a:springsource:spring_framework:5.0.1 High 8
> Highest
> https://nvd.nist.gov/vuln/detail/CVE-2018-15756
> Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x
> prior to 4.3.20, and older that depend on spring-boot-starter-web or
> spring-boot-starter-webflux are ready to serve static resources out of the
> box and are therefore vulnerable.
> Mitigation : Spring-core-5.0.1 is from Oct 2017, the latetst 5..1.7 is from
> May 2019
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
