[ARTEMIS-2413] Upgrade JGroups

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.4
• Fix Version/s: 2.21.0
• Assignee: Justin Bertram
• Reporter: Endre Jeges
• Created: 04/Jul/19 18:44
• Updated: 12/Apr/24 05:34
• Resolved: 04/Feb/22 18:59

Description

I have noticed with the OWASP dependency-check plugin (org.owasp:dependency-check-maven:5.0.0) that the currently used org.jgroups:jgroups:3.6.13.Final has a CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle') vulnerability. The problem has not been reported in the NVD database, therefore there is no CVE record.

The vulnerability has been addressed in version org.jgroups:jgroups:4.0.2.Final (at the moment the latest version is org.jgroups:jgroups:4.1.1.Final).

The org.jgroups:jgroups dependency would require an upgrade to resolve the vulnerability.

 

Issue Links

• is duplicated by: ARTEMIS-2469 Deprecate old JGroups properties syntax
• is duplicated by: ARTEMIS-2436 Upgrade Groups Version to 4.x
• is duplicated by: ARTEMIS-3066 Upgrade JGroups from 3.x to 5.x
• links to: GitHub Pull Request #3934