Impact of CVE-2023-46604 on activemq-client

2023-11-06 Thread Colm O hEigeartaigh
Hi, Security vendors (e.g. https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEACTIVEMQ-6039483) are flagging CVE-2023-46604 against activemq-client (I guess by looking at the changes to activemq-client https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436). However the

Re: Impact of CVE-2023-46604 on activemq-client

2023-11-06 Thread Jean-Baptiste Onofré
Hi Colm It's on the broker side, not on the client side. However, the change is also on client side as it's on the openwire marshalling (shared between the client and the broker). Regards JB On Mon, Nov 6, 2023 at 3:28 PM Colm O hEigeartaigh wrote: > > Hi, > > Security vendors (e.g. >