activemq-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Justin Bertram (JIRA)" <>
Subject [jira] [Updated] (ARTEMIS-1483) Upgrade beanutils
Date Fri, 27 Oct 2017 12:45:01 GMT


Justin Bertram updated ARTEMIS-1483:
    Fix Version/s: 2.4.0

> Upgrade beanutils
> -----------------
>                 Key: ARTEMIS-1483
>                 URL:
>             Project: ActiveMQ Artemis
>          Issue Type: Bug
>    Affects Versions: 2.3.0
>            Reporter: Mike Hearn
>            Assignee: Justin Bertram
>             Fix For: 2.4.0
> In ARTEMIS-309 the version of Apache Commons Collections was upgraded to 3.2.2 however,
this fix was not sufficient because ACC is also pulled in via Apache BeanUtils. This is a
potential problem because it is enough for the bad library to anywhere on the classpath, so
whether Artemis is vulnerable or not may depend on the vagaries of classpath ordering (if
both versions somehow end up in the distribution by mistake).
> BeanUtils has a 1.9.3 release where the dependency was upgraded to fix the CVE. If Artemis
upgrades to BeanUtils 1.9.3 the problem is resolved.
> We noticed this in our project using the OWASP Dependency Scanner:
> It'd be a great thing for you guys to start using this wonderful plugin too. The reports
it generates are excellent.

This message was sent by Atlassian JIRA

View raw message