July 2024 - wildfly-dev - Jboss List Archives

JDK 23 RDP2 | Removal of the legacy COMPAT locale provider and more heads-up!

by David Delabassee

Welcome to the OpenJDK Quality Outreach summer update. JDK 23 is now in Rampdown Phase Two [1], its overall feature has been frozen a few weeks ago. Per the JDK Release Process, we have now turned our focus to P1 and P2 bugs, which can be fixed with approval [2]. Late enhancements are still possible, with approval, but the bar is now extraordinarily high. That also means that the JDK 23 Initial Release Candidates are fast approaching, i.e., August 8th [3]! So, and in addition to testing your projects with the latest JDK 23 early-access builds, it is now a good time to start testing with the JDK 24 early-access builds. Make sure to also check the heads-up below as some are related to JDK 23 and might have some impact, i.e., the first one being related to the eventual removal of the Security Manager and the second one discusses the removal of the legacy COMPAT locale provider. [1] https://mail.openjdk.org/pipermail/jdk-dev/2024-July/009252.html [2] https://openjdk.org/jeps/3#rdp-2 [3] https://openjdk.org/projects/jdk/23/ ## Heads-up - JDK 23: Subject.getSubject API Requires Allowing the Security Manager In JDK 17 and as announced in JEP 411 [4], the Security Manager was deprecated for removal. As part of that change, several Security Manager APIs, such as `AccessControlContext`, were deprecated for removal. The `Subject::doAs` and `Subject::getSubject` APIs depend on Security Manager related APIs even though they do not require Security Manager to be installed to use them. As of JDK 23 [5], to help applications prepare for the eventual removal of the Security Manager, subject authorization and the Subject APIs' behavior depend on allowing the Security Manager: - If the system property `java.security.manager` is set on the command line to the empty string, a class name, or the value `allow` then there is no behavior change compared to previous releases. - If the system property `java.security.manager` is not set on the command line or has been set on the command line to the value `disallow`, invoking the `Subject.getSubject` method will throw `UnsupportedOperationException`. Yet, running an application with `-Djava.security.manager=allow` is a temporary workaround to keep older code working. Maintainers of code using `Subject.doAs` and `Subject.getSubject` are strongly encouraged to migrate it with utmost priority to the replacement APIs, `Subject.callAs` and `Subject.current`. Make sure to check [5] and [6] for additional details. The jdeprscan tool [7] scans a JAR file for usage of deprecated API elements and is helpful to find code using these methods. Additionally, consider migrating as soon as possible code that stores a `Subject` in an `AccessControlContext` and invokes `AccessController.doPrivileged` with that context. Such code will stop working when the Security Manager is removed. [4] https://openjdk.org/jeps/411 [5] https://jdk.java.net/23/release-notes#b15 [6] https://inside.java/2024/07/08/quality-heads-up/ [7] https://dev.java/learn/jvm/tools/core/jdeprscan/ ## Heads-up - JDK 23: Unicode / Removal of COMPAT Locale Provider ### A Quick History of Locale Data in the JDK Before the Unicode Consortium created the Common Locale Data Repository (CLDR) in 2003 to manage locale data, the JDK had to provide its own collection. It did so successfully and in JDK 8 supported about 160 locales. To reduce maintenance effort, allow better interoperability between platforms, and improve locale data quality, the JDK started to move towards CLDR in 2014: - JDK 8 comes with two locale data providers, which can be selected with the system property java.locale.providers: . JRE/COMPAT for the JDK’s legacy data collection (default) . CLDR for the CLDR data . a custom locale provider can be implemented - JDK 9 picks CLDR by default - JDK 21 issues a warning on JRE/COMPAT There are plenty of minor and a few notable differences between the legacy data and CLDR - the recently rewritten JEP 252 [8] lists a few of them. ### Locale Data in JDK 23 JDK 23 [9] removes legacy locale data. As a consequence, setting java.locale.providers to JRE or COMPAT has no effect. Projects that are still using legacy locale data are highly encouraged to switch to CLDR as soon as possible. Where that is infeasible, two alternatives remain: - Create custom formatters with patterns that mimic the legacy behavior and use them everywhere where locale-sensitive data is written or parsed. - Implement a custom locale data provider [10]. For more details on that as well as on CLDR in the JDK in general, please check JEP 252 [8] that has been recently rewritten to provide better information and guidance. [8] https://openjdk.org/jeps/252 [9] https://bugs.openjdk.org/browse/JDK-8325568 [10] https://docs.oracle.com/en/java/javase/22/docs/api/java.base/java/util/sp... ## Heads-up - JDK 23: Initial Leyden Early-Access Builds Project Leyden published its first early-access builds (24-leyden+2-8 2024/6/20) [11]. The initial release is focused on improving Java applications start-up time, but other Leyden optimizations will be explored in future releases. Below are some of the highlights of these Leyden EA builds: - Ahead-of-time compilation of Java methods to natively execute them as soon as the application starts up in the production run; - Ahead-of-time resolution of constant pool entries allows the AOT compiler to generate better code and for your application to start faster; - Ahead-of-time generation of Dynamic Proxies and reflection data as frameworks use those extensively during start-up time; - A unified Cache Data Store (CDS) archive to simplify the creation of the CDS archive, while supporting multiple types of optimization artifacts; - Loaded Classes in the CDS archive as soon the application starts up; - Class loader lookup cache to help application frameworks perform repeated lookups without repeatedly scanning the classpath; - Archived Method Profiles to reach Java application peak performance faster. The easiest way to start with Leyden features is by using the java program in the Leyden Early Access Release with the -XX:CacheDataStore flag. More details of this Leyden EA Build can be found in the release notes [12]. [11] https://jdk.java.net/leyden/ [12] https://github.com/openjdk/leyden/blob/leyden-ea1-release-notes/README.md ## JDK 23 Early-Access Builds The JDK 23 early-access builds 32 are available [13], and are provided under the GNU General Public License v2, with the Classpath Exception. The Release Notes are available here [14] and the Javadoc here [15]. [13] https://jdk.java.net/23/ [14] https://jdk.java.net/23/release-notes [15] https://download.java.net/java/early_access/jdk23/docs/api/ ## JDK 24 Early-Access Builds The JDK 24 early-access builds 7 are available [16], and are provided under the GNU General Public License v2, with the Classpath Exception. The Release Notes are available here [17]. ### Changes in recent JDK 24 builds that may be of interest: - JDK-8334299: Deprecate LockingMode option, along with LM_LEGACY and LM_MONITOR - JDK-8330846: Add stacks of mounted virtual threads to the HotSpot thread … - JDK-8333649: Allow different NativeCall encodings - JDK-8333755: NumberFormat integer only parsing breaks when format has suffix - JDK-8330842: Support AES CBC with Ciphertext Stealing (CTS) in SunPKCS11 - JDK-8327793: Deprecate jstatd for removal - JDK-8248981: Specify list of standard message digest and mgf algorithms for RSASSA-PSS signature - JDK-8334580: Deprecate no-arg constructor BasicSliderUI() for removal - JDK-8320448: Accelerate IndexOf using AVX2 - JDK-8333749: Consolidate ConstantDesc conversion in java.base - JDK-8329141: Obsolete RTM flags and code - JDK-8330198: Add some class loading related perf counters to measure VM startup - JDK-8330699: Obsolete -XX:+UseEmptySlotsInSupers - JDK-8334734: Remove specialized readXxxEntry methods from ClassReader This is only a curated list, a complete list of changes can be found here [18]. [16] https://jdk.java.net/24/ [17] https://jdk.java.net/24/release-notes [18] https://github.com/openjdk/jdk/compare/jdk-24+0...jdk-24+7 ## Topics of Interest - Integrity by Default - Inside Java Newscast https://inside.java/2024/07/18/newscast-73/ - Java and AI? - Inside Java Newscast https://inside.java/2024/07/04/newscast-72/ - What Happened to String Templates? - Inside Java Newscast https://inside.java/2024/06/20/newscast-71/ - Java Language Futures - Spring 2024 Edition https://inside.java/2024/07/01/java-language-futures/ - Project Loom - Structured Concurrency https://inside.java/2024/07/13/structured-concurrency/ - How to Build Custom Java Runtimes with Jlink https://inside.java/2024/06/21/build-runtimes-with-jlink/ ## July 2024 Critical Patch Update Released As part of the July 2024 CPU, Oracle released OpenJDK 22.0.2, JavaFX 22.0.2, JDK 22.0.2, JDK 21.0.4 LTS, JDK 17.0.12 LTS, JDK 11.0.24 LTS, JDK 8u421 as as well as JDK 8u421-perf. ~ We still have a few days before JDK 23 enters into the Release Candidate phase so please make sure to test your projects on the latest early-access builds and report any issue… but that shouldn't be a reason to not enjoy the summer and recharge your batteries! 😎 --David

1 year, 5 months

1
0
0 / 0

Re: Vulnerabilities in wildfly version 32.0.1.Final

by Pawan Verma -X (pawverma - INFOSYS LIMITED＠Cisco)

Thanks for clarifying Emmanuel Hugonnet and Brian Stansberry !! I need to correct myself after looking into the vulnerability scan report of our applications. These vulnerabilities are not from WildFly. the only vulnerability relevant is undertow-core, version 2.3.12.Final or 2.3.13.Final --> CVE-2024-6162 And as updated in the thread, the fix is coming in 33.0.0.Final (Undertow 2.3.15). Thanks, Pawan Today's Topics: 1. Re: Vulnerabilities in wildfly version 32.0.1.Final (Emmanuel Hugonnet) 2. Re: Vulnerabilities in wildfly version 32.0.1.Final (Brian Stansberry) 3. Possible component upgrades report - wildfly-core:main (thofman(a)redhat.com) ---------------------------------------------------------------------- Date: Thu, 18 Jul 2024 09:43:31 +0200 From: Emmanuel Hugonnet <ehugonne(a)redhat.com> Subject: [wildfly-dev] Re: Vulnerabilities in wildfly version 32.0.1.Final To: wildfly-dev(a)lists.jboss.org Message-ID: <3667d018-ef45-474a-a53b-005dc0fb069d(a)redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Le 17/07/2024 à 17:12, Pawan Verma -X (pawverma - INFOSYS LIMITED at Cisco) via wildfly-dev a écrit : > > We are seeing some critical and high vulnerabilities in some of the > packages which are bundled along with wildfly 32.0.1.Final > > 1. dom4j:1.6 --> CVE-2020-10683 (critical) > > 2. aws-java-sdk-s3:1.11.750 --> CVE-2022-45688 (high) > > 3. json , version 20201115 --> CVE-2022-45688 (high) > > 4. undertow-core, version 2.3.12.Final --> CVE-2024-6162 (high) > > 5. xnio-api, version 3.8.13.Final --> CVE-2023-5685 (high) > > 6. activemq-artemis-native, version 2.0.0 --> CVE-2022-41678 (high) > This is wrong, it is not the native part that is for this CVE but the jokolia support which we don't provide > 7. spring-web, version 6.1.5 --> CVE-2024-22262 (high) > Not provided by us > 8. wildfly-elytron-realm-token, version 2.2.3.Final --> CVE-2024-1233 > (high) > > 9. soap, version 2.3.1 --> CVE-2022-45378 > > Any guidance on how we can rectify these vulnerabilities while using > wildfly 32.0.1.Final > > Thanks, > > Pawan > > > _______________________________________________ > wildfly-dev mailing list -- wildfly-dev(a)lists.jboss.org To unsubscribe > send an email to wildfly-dev-leave(a)lists.jboss.org Privacy Statement: > https://www.redhat.com/en/about/privacy-policy > List Archives: > https://lists.jboss.org/archives/list/wildfly-dev@lists.jboss.org/mess > age/PWDCK5752TX5BMRA6MZE76V4QUR74XG7/ ------------------------------ Date: Thu, 18 Jul 2024 08:56:12 -0500 From: Brian Stansberry <brian.stansberry(a)redhat.com> Subject: [wildfly-dev] Re: Vulnerabilities in wildfly version 32.0.1.Final To: Emmanuel Hugonnet <ehugonne(a)redhat.com> Cc: wildfly-dev(a)lists.jboss.org Message-ID: <CAPhbRDZKLkcnNji9yW01bdk672CkoDT2H13d0Knqs9pMe+WcHw(a)mail.gmail.com> Content-Type: multipart/alternative; boundary="000000000000a23c34061d85f2b3" --000000000000a23c34061d85f2b3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jul 18, 2024 at 2:44=E2=80=AFAM Emmanuel Hugonnet <ehugonne(a)redhat.= com> wrote: > > > Le 17/07/2024 =C3=A0 17:12, Pawan Verma -X (pawverma - INFOSYS LIMITED > at > Cisco) via wildfly-dev a =C3=A9crit : > > > > We are seeing some critical and high vulnerabilities in some of the > packages which are bundled along with wildfly 32.0.1.Final > > > > 1. dom4j:1.6 --> CVE-2020-10683 (critical) > > > This is not provided by a WildFly server. We do use dom4j in our testsuite, but not as part of the server. > 2. aws-java-sdk-s3:1.11.750 --> CVE-2022-45688 (high) > > > We use version 2.20.126 in 32.0.1. Also CVE-2022-45688 doesn't seem related to this library. > 3. json , version 20201115 --> CVE-2022-45688 (high) > > > CVE-2022-45688 doesn't seem related to this library., although I'm not sure what library this line refers to. > > 4. undertow-core, version 2.3.12.Final --> CVE-2024-6162 (high) > > > This is fixed in Undertow 2.3.15, which will be in the imminent 33.0.0.Final. 32.0.1 uses 2.3.13. > 5. xnio-api, version 3.8.13.Final --> git l (high) > > > This was fixed in 32.0.1.Final via https://issues.redhat.com/browse/WFCORE-6738. > 6. activemq-artemis-native, version 2.0.0 --> CVE-2022-41678 (high) > > > This is wrong, it is not the native part that is for this CVE but the > jokolia support which we don't provide > > > 7. spring-web, version 6.1.5 --> CVE-2024-22262 (high) > > > Not provided by us > > > 8. wildfly-elytron-realm-token, version 2.2.3.Final --> > > CVE-2024-1233 > (high) > > > This was fixed in 32.0.1 via https://issues.redhat.com/browse/WFCORE-6780 and https://issues.redhat.com/browse/WFCORE-6787. > 9. soap, version 2.3.1 --> CVE-2022-45378 > > We don't use Apache SOAP. > > > Any guidance on how we can rectify these vulnerabilities while using > wildfly 32.0.1.Final > > > > Thanks, > > > > Pawan > > > > > > _______________________________________________ > > wildfly-dev mailing list -- wildfly-dev(a)lists.jboss.org To > > unsubscribe send an email to wildfly-dev-leave(a)lists.jboss.org > > Privacy Statement: https://www.redhat.com/en/about/privacy-policy > > List Archives: > https://lists.jboss.org/archives/list/wildfly-dev@lists.jboss.org/mess > age= /PWDCK5752TX5BMRA6MZE76V4QUR74XG7/ > _______________________________________________ > wildfly-dev mailing list -- wildfly-dev(a)lists.jboss.org To unsubscribe > send an email to wildfly-dev-leave(a)lists.jboss.org Privacy Statement: > https://www.redhat.com/en/about/privacy-policy > List Archives: > https://lists.jboss.org/archives/list/wildfly-dev@lists.jboss.org/mess > age= /IZZQ7MOHWWCUDS5RVBPUWUFTYOKEMKUB/ > --=20 Brian Stansberry Principal Architect, Red Hat JBoss EAP WildFly Project Lead He/Him/His --000000000000a23c34061d85f2b3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon= t-family:"trebuchet ms",sans-serif"><br></div></div><br><div clas= s=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Jul 18, 202= 4 at 2:44=E2=80=AFAM Emmanuel Hugonnet <<a href=3D"mailto:ehugonne@redha= t.com">ehugonne(a)redhat.com</a>> wrote:<br></div><blockquote class=3D"gma= il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2= 04,204);padding-left:1ex"><br> <br> Le 17/07/2024 =C3=A0 17:12, Pawan Verma -X (pawverma - INFOSYS LIMITED at C= isco) via wildfly-dev a =C3=A9crit=C2=A0:<br> ><br> > We are seeing some critical and high vulnerabilities in some of the pa= ckages which are bundled along with wildfly 32.0.1.Final<br> ><br> > 1. dom4j:1.6 --> CVE-2020-10683 (critical)<br> ><br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"f= ont-family:"trebuchet ms",sans-serif">This is not provided by a W= ildFly server. We do use dom4j in our testsuite, but not as part of the ser= ver.</div><div class=3D"gmail_default" style=3D"font-family:"trebuchet= ms",sans-serif"><br></div><blockquote class=3D"gmail_quote" style=3D"= margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef= t:1ex"> > 2. aws-java-sdk-s3:1.11.750 --> CVE-2022-45688 (high)<br> ><br></blockquote><div><br></div><div class=3D"gmail_default" style=3D""= ><font face=3D"trebuchet ms, sans-serif">We use >version</font>=C2=A02.20.12= 6 in 32.0.1. Also CVE-2022-45688 doesn't seem related to this library.<= /div><div class=3D"gmail_default" style=3D""><br></div> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-= left:1px solid rgb(204,204,204);padding-left:1ex"> > 3. json , version 20201115 --> CVE-2022-45688 (high)<br> ><br></blockquote><div><br></div><div>CVE-2022-45688 doesn't seem re= lated to this library.<span class=3D"gmail_default" style=3D"font-family:&q= uot;trebuchet ms",sans-serif">, although I'm not sure what library= this line refers to.</span></div><div>=C2=A0</div><blockquote class=3D"gma= il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2= 04,204);padding-left:1ex"> > 4. undertow-core, version 2.3.12.Final --> CVE-2024-6162 (high)<br> ><br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"f= ont-family:"trebuchet ms",sans-serif">This is fixed in Undertow 2= .3.15, which will be in the imminent 33.0.0.Final.=C2=A0 32.0.1 uses 2.3.13= .</div><div class=3D"gmail_default" style=3D"font-family:"trebuchet ms= ",sans-serif"><br></div><blockquote class=3D"gmail_quote" style=3D"mar= gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1= ex"> > 5. xnio-api, version 3.8.13.Final --> <span class=3D"gmail_default"= style=3D"font-family:"trebuchet ms",sans-serif"></span>g<span cl= ass=3D"gmail_default" style=3D"font-family:"trebuchet ms",sans-se= rif">it l</span> (high)<br> ><br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"f= ont-family:"trebuchet ms",sans-serif">This was fixed in 32.0.1.Fi= nal via=C2=A0<a href=3D"https://issues.redhat.com/browse/WFCORE-6738">https= ://issues.redhat.com/browse/WFCORE-6738</a>.</div><div class=3D"gmail_defau= lt" style=3D"font-family:"trebuchet ms",sans-serif"><br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex"> > 6. activemq-artemis-native, version 2.0.0 --> CVE-2022-41678 (high)= <br> ><br> This is wrong, it is not the native part that is for this CVE but the jokol= ia support which we don't provide<br> <br> > 7. spring-web, version 6.1.5 --> CVE-2024-22262 (high)<br> ><br> Not provided by us<br> <br> > 8. wildfly-elytron-realm-token, version 2.2.3.Final --> CVE-2024-12= 33 (high)<br> ><br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"f= ont-family:"trebuchet ms",sans-serif">This was fixed in 32.0.1 vi= a=C2=A0<a href=3D"https://issues.redhat.com/browse/WFCORE-6780">https://iss= ues.redhat.com/browse/WFCORE-6780</a> and=C2=A0<a href=3D"https://issues.re= dhat.com/browse/WFCORE-6787">https://issues.redhat.com/browse/WFCORE-6787</= a>.</div><div class=3D"gmail_default" a>style=3D"font-family:"trebuchet = ms",sans-serif"><br></div><blockquote class=3D"gmail_quote" style=3D"m= argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left= :1ex"> > 9. soap, version 2.3.1 --> CVE-2022-45378<br> ><span class=3D"gmail_default" style=3D"font-family:"trebuchet ms&q= uot;,sans-serif"></span></blockquote><div><span class=3D"gmail_default" sty= le=3D"font-family:"trebuchet ms",sans-serif"></span></div><div><s= pan class=3D"gmail_default" style=3D"font-family:"trebuchet ms",s= ans-serif">We don't use Apache SOAP.</span></div><div>=C2=A0</div><bloc= kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:= 1px solid rgb(204,204,204);padding-left:1ex"><br> > Any guidance on how we can rectify these vulnerabilities while using w= ildfly 32.0.1.Final<br> ><br> > Thanks,<br> ><br> > Pawan<br> ><br> ><br> > _______________________________________________<br> > wildfly-dev mailing list -- <a href=3D"mailto:wildfly-dev@lists.jboss.= org" target=3D"_blank">wildfly-dev(a)lists.jboss.org</a><br> > To unsubscribe send an email to <a href=3D"mailto:wildfly-dev-leave@li= sts.jboss.org" target=3D"_blank">wildfly-dev-leave(a)lists.jboss.org</a><br> > Privacy Statement: <a href=3D"https://www.redhat.com/en/about/privacy-= policy" rel=3D"noreferrer" target=3D"_blank">https://www.redhat.com/en/abou= t/privacy-policy</a><br> > List Archives: <a href=3D"https://lists.jboss.org/archives/list/wildfl= y-dev(a)lists.jboss.org/message/PWDCK5752TX5BMRA6MZE76V4QUR74XG7/" rel=3D"nor= eferrer" target=3D"_blank">https://lists.jboss.org/archives/list/wildfly-de= v(a)lists.jboss.org/message/PWDCK5752TX5BMRA6MZE76V4QUR74XG7/</a><br> _______________________________________________<br> wildfly-dev mailing list -- <a href=3D"mailto:wildfly-dev@lists.jboss.org" = target=3D"_blank">wildfly-dev(a)lists.jboss.org</a><br> To unsubscribe send an email to <a href=3D"mailto:wildfly-dev-leave@lists.j= boss.org" target=3D"_blank">wildfly-dev-leave(a)lists.jboss.org</a><br> Privacy Statement: <a href=3D"https://www.redhat.com/en/about/privacy-polic= y" rel=3D"noreferrer" target=3D"_blank">https://www.redhat.com/en/about/pri= vacy-policy</a><br> List Archives: <a href=3D"https://lists.jboss.org/archives/list/wildfly-dev= @lists.jboss.org/message/IZZQ7MOHWWCUDS5RVBPUWUFTYOKEMKUB/" rel=3D"noreferr= er" target=3D"_blank">https://lists.jboss.org/archives/list/wildfly-dev@lis= ts.jboss.org/message/IZZQ7MOHWWCUDS5RVBPUWUFTYOKEMKUB/</a><br> </blockquote></div><br clear=3D"all"><div><br></div><span class=3D"gmail_si= gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d= iv dir=3D"ltr">Brian Stansberry<div>Principal Architect, Red Hat JBoss EAP<= /div><div>WildFly Project Lead</div><div>He/Him/His</div></div></div></div> --000000000000a23c34061d85f2b3-- ------------------------------ Date: Sat, 20 Jul 2024 17:09:35 -0400 (EDT) From: thofman(a)redhat.com Subject: [wildfly-dev] Possible component upgrades report - wildfly-core:main To: wildfly-dev(a)lists.jboss.org, thofman(a)redhat.com Message-ID: <1819225127.1.1721509767767.JavaMail.jenkins@89db05588a11> Content-Type: multipart/mixed; boundary="----=_Part_0_1911679541.1721509767752" ------=_Part_0_1911679541.1721509767752 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div style=3D"font-family: Verdana,sans-serif;font-size: 10pt;"><h2>Compone= nt Upgrade Report</h2><p>Following repositories were searched:</p><ul style= =3D"list-style-type: circle;"><li style=3D"margin: 7px 0;"><span style=3D"b= order-radius: 5px;padding: 3px;background-color: #a8df65;">Central</span> h= ttps://repo1.maven.org/maven2/</li><li style=3D"margin: 7px 0;"><span style= =3D"border-radius: 5px;padding: 3px;background-color: #edf492;">JBossPublic= </span> https://repository.jboss.org/nexus/content/repositories/public/</li= ></ul><table style=3D"font-family: Verdana,sans-serif;font-size: >10pt;margi= n: 2em 0;border-collapse: collapse;"><caption style=3D"text-align: left;fon= t-weight: bold;">Possible Component Upgrades</caption><thead><tr><th style= =3D"border-bottom: 1px solid #ddd;padding: 5px;text-align: left;">GAV</th><= th style=3D"border-bottom: 1px solid #ddd;padding: 5px;text-align: left;">N= ew Version</th><th style=3D"border-bottom: 1px solid #ddd;padding: 5px;text= -align: left;">Repository</th><th style=3D"border-bottom: 1px solid #ddd;pa= dding: 5px;text-align: left;">Since</th></tr></thead><tbody><tr><tr><td sty= le=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier= New";">commons-daemon:commons-daemon:1.3.4</td><td style=3D"border-bo= ttom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px s= olid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;p= adding: 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid= #ddd;padding: 5px;font-family: "Courier New";padding-left: 2em; = color: #999;">↳ Minor upgrade</td><td style=3D"border-bottom: 1px sol= id #ddd;padding: 5px;">1.4.0</td><td style=3D"border-bottom: 1px solid #ddd= ;padding: 5px;"><span style=3D"border-radius: 5px;padding: 3px;background-c= olor: #a8df65;">Central</span></td><td style=3D"border-bottom: 1px solid #d= dd;padding: 5px;">2024-05-25</td></tr></tr></tbody><tbody><tr><tr><td style= =3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier N= ew";">jakarta.authentication:jakarta.authentication-api:3.0.0</td><td = style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"bo= rder-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom= : 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td style=3D"border= -bottom: 1px solid #ddd;padding: 5px;font-family: "Courier New";p= adding-left: 2em; color: #999;">↳ Minor upgrade</td><td style=3D"bord= er-bottom: 1px solid #ddd;padding: 5px;">3.1.0</td><td style=3D"border-bott= om: 1px solid #ddd;padding: 5px;"><span style=3D"border-radius: 5px;padding= : 3px;background-color: #a8df65;">Central</span></td><td style=3D"border-bo= ttom: 1px solid #ddd;padding: 5px;">2024-06-22</td></tr></tr></tbody><tbody= ><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: >5px;font-famil= y: "Courier New";">jakarta.authorization:jakarta.authorization-ap= i:2.1.0</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td= ><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td >style= =3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><t= d style=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Co= urier New";padding-left: 2em; color: #999;">↳ Very latest</td><t= d style=3D"border-bottom: 1px solid #ddd;padding: 5px;">3.0.0</td><td style= =3D"border-bottom: 1px solid #ddd;padding: 5px;"><span style=3D"border-radi= us: 5px;padding: 3px;background-color: #a8df65;">Central</span></td><td sty= le=3D"border-bottom: 1px solid #ddd;padding: 5px;">2024-05-18</td></tr></tr= ></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px solid >#ddd;padding:= 5px;font-family: "Courier New";">jakarta.interceptor:jakarta.int= erceptor-api:2.1.0</td><td style=3D"border-bottom: 1px solid #ddd;padding: = 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td= ><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> ></td></tr></tr>= <tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family= : "Courier New";padding-left: 2em; color: #999;">↳ Minor up= grade</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">2.2.0</= td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span td>style=3D= "border-radius: 5px;padding: 3px;background-color: #a8df65;">Central</span>= </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">2024-04-13</= td></tr></tr></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px td>solid #= ddd;padding: 5px;font-family: "Courier New";">org.aesh:aesh:2.4</= td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td td>styl= e=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border= -bottom: 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td style=3D= "border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier New&= quot;;padding-left: 2em; color: #999;">↳ Minor upgrade</td><td style= =3D"border-bottom: 1px solid #ddd;padding: 5px;">2.8.2</td><td style=3D"bor= der-bottom: 1px solid #ddd;padding: 5px;"><span style=3D"border-radius: 5px= ;padding: 3px;background-color: #a8df65;">Central</span></td><td style=3D"b= order-bottom: 1px solid #ddd;padding: 5px;">2024-06-29</td></tr></tr></tbod= y><tbody><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: y>5px;fo= nt-family: "Courier New";">org.aesh:readline:2.2</td><td style=3D= "border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bot= tom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px so= lid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom:= 1px solid #ddd;padding: 5px;font-family: "Courier New";padding-l= eft: 2em; color: #999;">↳ Minor upgrade</td><td style=3D"border-botto= m: 1px solid #ddd;padding: 5px;">2.6</td><td style=3D"border-bottom: 1px so= lid #ddd;padding: 5px;"><span style=3D"border-radius: 5px;padding: 3px;back= ground-color: #a8df65;">Central</span></td><td style=3D"border-bottom: 1px = solid #ddd;padding: 5px;">2024-06-29</td></tr></tr></tbody><tbody><tr><tr><= td style=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "C= ourier New";">org.apache.commons:commons-lang3:3.14.0</td><td style=3D= "border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bot= tom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px so= lid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom:= 1px solid #ddd;padding: 5px;font-family: "Courier New";padding-l= eft: 2em; color: #999;background-color: #fffeec;">↳ Minor upgrade</td= ><td style=3D"border-bottom: 1px solid #ddd;padding: >5px;background-color: = #fffeec;">3.15.0</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5p= x;background-color: #fffeec;"><span style=3D"border-radius: 5px;padding: 3p= x;background-color: #a8df65;">Central</span></td><td style=3D"border-bottom= : 1px solid #ddd;padding: 5px;background-color: #fffeec;">new</td></tr></tr= ></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px solid >#ddd;padding:= 5px;font-family: "Courier New";">org.apache.logging.log4j:log4j-= api:2.22.1</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> <= /td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td sty= le=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr>= <td style=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "= Courier New";padding-left: 2em; color: #999;">↳ Minor upgrade</t= d><td style=3D"border-bottom: 1px solid #ddd;padding: d>5px;">2.23.1</td><td = style=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span style=3D"border= -radius: 5px;padding: 3px;background-color: #a8df65;">Central</span></td><t= d style=3D"border-bottom: 1px solid #ddd;padding: 5px;">2024-03-16</td></tr= ></tr></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px solid >#ddd;pad= ding: 5px;font-family: "Courier New";">org.apache.maven:maven-res= olver-provider:3.5.4</td><td style=3D"border-bottom: 1px solid #ddd;padding= : 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </= td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> td></td></tr></t= r><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: r>5px;font-fami= ly: "Courier New";padding-left: 2em; color: #999;">↳ Minor = upgrade</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">3.9.8= </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span style= =3D"border-radius: 5px;padding: 3px;background-color: #a8df65;">Central</sp= an></td><td style=3D"border-bottom: 1px solid #ddd;padding: an>5px;">2024-06-2= 2</td></tr></tr></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px soli= d #ddd;padding: 5px;font-family: "Courier New";">org.apache.maven= .resolver:maven-resolver-api:1.1.1</td><td style=3D"border-bottom: 1px soli= d #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padd= ing: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">= </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding:= 5px;font-family: "Courier New";padding-left: 2em; color: #999;">= ↳ Minor upgrade</td><td style=3D"border-bottom: 1px solid #ddd;paddin= g: 5px;">1.9.21</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px= ;"><span style=3D"border-radius: 5px;padding: 3px;background-color: #a8df65= ;">Central</span></td><td style=3D"border-bottom: 1px solid #ddd;padding: 5= px;">2024-07-06</td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid= #ddd;padding: 5px;font-family: "Courier New";padding-left: 2em; = color: #999;">↳ Very latest</td><td style=3D"border-bottom: 1px solid= #ddd;padding: 5px;">2.0.0</td><td style=3D"border-bottom: 1px solid #ddd;p= adding: 5px;"><span style=3D"border-radius: 5px;padding: 3px;background-col= or: #a8df65;">Central</span></td><td style=3D"border-bottom: 1px solid #ddd= ;padding: 5px;">2024-07-06</td></tr></tr></tbody><tbody><tr><tr><td style= =3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier N= ew";">org.apache.sshd:sshd-common:2.12.1</td><td style=3D"border-botto= m: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px soli= d #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padd= ing: 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid #d= dd;padding: 5px;font-family: "Courier New";padding-left: 2em; col= or: #999;">↳ Minor upgrade</td><td style=3D"border-bottom: 1px solid = #ddd;padding: 5px;">2.13.1</td><td style=3D"border-bottom: 1px solid #ddd;p= adding: 5px;"><span style=3D"border-radius: 5px;padding: 3px;background-col= or: #a8df65;">Central</span></td><td style=3D"border-bottom: 1px solid #ddd= ;padding: 5px;">2024-06-29</td></tr></tr></tbody><tbody><tr><tr><td style= =3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier N= ew";">org.fusesource.jansi:jansi:1.18</td><td style=3D"border-bottom: = 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #= ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding= : 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid #ddd;= padding: 5px;font-family: "Courier New";padding-left: 2em; color:= #999;">↳ Very latest</td><td style=3D"border-bottom: 1px solid #ddd;= padding: 5px;">2.4.1</td><td style=3D"border-bottom: 1px solid #ddd;padding= : 5px;"><span style=3D"border-radius: 5px;padding: 3px;background-color: #a= 8df65;">Central</span></td><td style=3D"border-bottom: 1px solid #ddd;paddi= ng: 5px;">2024-02-10</td></tr></tr></tbody><tbody><tr><tr><td style=3D"bord= er-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier New"= ;">org.glassfish:jakarta.json:1.1.6</td><td style=3D"border-bottom: 1px sol= id #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;pad= ding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"= > </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid > #ddd;padding= : 5px;font-family: "Courier New";padding-left: 2em; color: #999;"= >↳ Very latest</td><td style=3D"border-bottom: 1px solid >#ddd;padding= : 5px;">2.0.1</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"= ><span style=3D"border-radius: 5px;padding: 3px;background-color: >#a8df65;"= Central</span></td><td style=3D"border-bottom: 1px solid >#ddd;padding: 5px= ;">2024-02-10</td></tr></tr></tbody><tbody><tr><tr><td style=3D"border-bott= om: 1px solid #ddd;padding: 5px;font-family: "Courier New";">org.= jboss.logging:jboss-logging:3.5.3.Final</td><td style=3D"border-bottom: 1px= solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd= ;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5= px;"> </td></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid #ddd;pad= ding: 5px;font-family: "Courier New";padding-left: 2em; color: #9= 99;">↳ Minor upgrade</td><td style=3D"border-bottom: 1px solid #ddd;p= adding: 5px;">3.6.0.Final</td><td style=3D"border-bottom: 1px solid #ddd;pa= dding: 5px;"><span style=3D"border-radius: 5px;padding: 3px;background-colo= r: #a8df65;">Central</span></td><td style=3D"border-bottom: 1px solid #ddd;= padding: 5px;">2024-05-11</td></tr></tr></tbody><tbody><tr><tr><td style=3D= "border-bottom: 1px solid #ddd;padding: 5px;font-family: "Courier New&= quot;;">org.jboss.logging:jboss-logging-annotations:2.2.1.Final</td><td sty= le=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"borde= r-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D"border-bottom: 1= px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td style=3D"border-bo= ttom: 1px solid #ddd;padding: 5px;font-family: "Courier New";padd= ing-left: 2em; color: #999;">↳ Very latest</td><td style=3D"border-bo= ttom: 1px solid #ddd;padding: 5px;">3.0.0.Final</td><td style=3D"border-bot= tom: 1px solid #ddd;padding: 5px;"><span style=3D"border-radius: 5px;paddin= g: 3px;background-color: #a8df65;">Central</span></td><td style=3D"border-b= ottom: 1px solid #ddd;padding: 5px;">2024-07-06</td></tr></tr></tbody><tbod= y><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: y>5px;font-fami= ly: "Courier New";">org.jboss.logmanager:jboss-logmanager:2.1.19.= Final</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><= td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><td style=3D= "border-bottom: 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr><tr><td s= tyle=3D"border-bottom: 1px solid #ddd;padding: 5px;font-family: "Couri= er New";padding-left: 2em; color: #999;">↳ Very latest</td><td s= tyle=3D"border-bottom: 1px solid #ddd;padding: 5px;">3.0.6.Final</td><td st= yle=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span style=3D"border-r= adius: 5px;padding: 3px;background-color: #a8df65;">Central</span></td><td = style=3D"border-bottom: 1px solid #ddd;padding: 5px;">2024-05-04</td></tr><= /tr></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px solid #ddd;paddi= ng: 5px;font-family: "Courier New";">org.jboss.threads:jboss-thre= ads:2.4.0.Final</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px= ;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td><t= d style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td></tr></tr><tr= ><tr><td style=3D"border-bottom: 1px solid #ddd;padding: >5px;font-family: &= quot;Courier New";padding-left: 2em; color: #999;">↳ Very latest= </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">3.6.1.Final<= /td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span style= =3D"border-radius: 5px;padding: 3px;background-color: #a8df65;">Central</sp= an></td><td style=3D"border-bottom: 1px solid #ddd;padding: an>5px;">2024-03-3= 0</td></tr></tr></tbody><tbody><tr><tr><td style=3D"border-bottom: 1px soli= d #ddd;padding: 5px;font-family: "Courier New";">org.wildfly.comm= on:wildfly-common:1.7.0.Final</td><td style=3D"border-bottom: 1px solid #dd= d;padding: 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: = 5px;"> </td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"> </td= ></tr></tr><tr><tr><td style=3D"border-bottom: 1px solid #ddd;padding: >5px;= font-family: "Courier New";padding-left: 2em; color: #999;">&#862= 7; Very latest</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;= ">2.0.0</td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;"><span= style=3D"border-radius: 5px;padding: 3px;background-color: #a8df65;">Centr= al</span></td><td style=3D"border-bottom: 1px solid #ddd;padding: 5px;">202= 4-05-11</td></tr></tr></tbody><tr><td style=3D"border-bottom: 1px solid #dd= d;padding: 5px;text-align: left;" colspan=3D"4">18 items</td></tr></table><= p>Generated on 2024-07-20</p><p style=3D"color: #999;">Report generated p>by = <a href=3D"https://github.com/jboss-set/maven-dependency-updater" style=3D"= color: #999;">Maven Dependency Updater</a></p></div> ------=_Part_0_1911679541.1721509767752-- ------------------------------ Subject: Digest Footer _______________________________________________ wildfly-dev mailing list -- wildfly-dev(a)lists.jboss.org To unsubscribe send an email to wildfly-dev-leave(a)lists.jboss.org Privacy Statement: https://www.redhat.com/en/about/privacy-policy ------------------------------ End of wildfly-dev Digest, Vol 134, Issue 12 ********************************************

1 year, 5 months

1
0
0 / 0

Possible component upgrades report - elytron-web:master

by thofman＠redhat.com

1 year, 5 months

1
0
0 / 0

Possible component upgrades report - wildfly-core:main

by thofman＠redhat.com

1 year, 5 months

1
0
0 / 0

Re: Vulnerabilities in wildfly version 32.0.1.Final

by Emmanuel Hugonnet

Le 17/07/2024 à 17:12, Pawan Verma -X (pawverma - INFOSYS LIMITED at Cisco) via wildfly-dev a écrit : > > We are seeing some critical and high vulnerabilities in some of the packages which are bundled along with wildfly 32.0.1.Final > > 1. dom4j:1.6 --> CVE-2020-10683 (critical) > > 2. aws-java-sdk-s3:1.11.750 --> CVE-2022-45688 (high) > > 3. json , version 20201115 --> CVE-2022-45688 (high) > > 4. undertow-core, version 2.3.12.Final --> CVE-2024-6162 (high) > > 5. xnio-api, version 3.8.13.Final --> CVE-2023-5685 (high) > > 6. activemq-artemis-native, version 2.0.0 --> CVE-2022-41678 (high) > This is wrong, it is not the native part that is for this CVE but the jokolia support which we don't provide > 7. spring-web, version 6.1.5 --> CVE-2024-22262 (high) > Not provided by us > 8. wildfly-elytron-realm-token, version 2.2.3.Final --> CVE-2024-1233 (high) > > 9. soap, version 2.3.1 --> CVE-2022-45378 > > Any guidance on how we can rectify these vulnerabilities while using wildfly 32.0.1.Final > > Thanks, > > Pawan > > > _______________________________________________ > wildfly-dev mailing list -- wildfly-dev(a)lists.jboss.org > To unsubscribe send an email to wildfly-dev-leave(a)lists.jboss.org > Privacy Statement: https://www.redhat.com/en/about/privacy-policy > List Archives: https://lists.jboss.org/archives/list/wildfly-dev@lists.jboss.org/message...

1 year, 5 months

2
1
0 / 0

WildFly 33 Schedule

by Brian Stansberry

We're aiming to have WildFly 33.0.0.Final available on wildfly.org on Thursday, July 18. The beta should be available on July 4. Following are the key dates: Wed Jun 26 -- Feature Freeze Mon Jul 1 -- WF Core Beta release Wed Jul 3 -- Tag/deploy 33 Beta Thu Jul 4 -- Announce release Wed Jul 10 -- Final PRs due Mon Jul 15 -- WF Core Final release Wed Jul 17 -- Tag/deploy 33 Final Thu Jul 18 -- Release available on wildfly.org Fri Jul 19 -- Post release deliverables Best regards, -- Brian Stansberry Principal Architect, Red Hat JBoss EAP WildFly Project Lead He/Him/His

1 year, 5 months

1
1
0 / 0

Possible component upgrades report - wildfly:main

by thofman＠redhat.com

1 year, 5 months

1
0
0 / 0

Vulnerabilities in wildfly version 32.0.1.Final

by Pawan Verma -X (pawverma - INFOSYS LIMITED＠Cisco)

We are seeing some critical and high vulnerabilities in some of the packages which are bundled along with wildfly 32.0.1.Final 1. dom4j:1.6 --> CVE-2020-10683 (critical) 2. aws-java-sdk-s3:1.11.750 --> CVE-2022-45688 (high) 3. json , version 20201115 --> CVE-2022-45688 (high) 4. undertow-core, version 2.3.12.Final --> CVE-2024-6162 (high) 5. xnio-api, version 3.8.13.Final --> CVE-2023-5685 (high) 6. activemq-artemis-native, version 2.0.0 --> CVE-2022-41678 (high) 7. spring-web, version 6.1.5 --> CVE-2024-22262 (high) 8. wildfly-elytron-realm-token, version 2.2.3.Final --> CVE-2024-1233 (high) 9. soap, version 2.3.1 --> CVE-2022-45378 Any guidance on how we can rectify these vulnerabilities while using wildfly 32.0.1.Final? Thanks, Pawan

1 year, 5 months

1
0
0 / 0

Possible component upgrades report - wildfly-elytron:1.x

by thofman＠redhat.com

1 year, 5 months

1
0
0 / 0

Possible component upgrades report - elytron-web:master

by thofman＠redhat.com

1 year, 5 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

wildfly-dev July 2024