[ARTEMIS-3348] update hawtio

• Type: Dependency upgrade
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.17.0
• Fix Version/s: 2.18.0
• Component/s: Web Console
• Assignee: Unassigned
• Reporter: Robbie Gemmell
• Created: 15/Jun/21 10:55
• Updated: 09/Aug/21 17:57
• Resolved: 15/Jun/21 14:10

Description

Update hawtio to 2.13.4.

 

The existing 2.13.2 version used by the console uses an older version of commons-io susceptible to a path traversal CVE https://nvd.nist.gov/vuln/detail/CVE-2021-29425, which affects < 2.7.0.

 

The only differences from 2.13.2 were dependency upgrades for commons-io and jackson to get various CVE fixes such as the above:
https://github.com/hawtio/hawtio/compare/hawtio-2.13.2...hawtio-2.13.4

Issue Links

• is part of: ARTEMIS-3347 update commons-io