[TOMEE-3768] TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.0.6, 8.0.7, 8.0.8
• Fix Version/s: 8.0.9
• Labels: CVE
• Assignee: Unassigned
• Reporter: Jayaprakash
• Created: 05/Jul/21 06:37
• Updated: 15/Feb/22 17:19
• Resolved: 15/Feb/22 17:19

Description

Issue: 
This vulnerability is caused by JsonMapObjectReaderWriter.class of cxf-rt-rs-json-basic.jar. When a malformed JSON is submitted to a web service, it results in thread getting stuck in an infinite loop, consuming CPU indefinitely. 

This is resolved from Apache CXF 3.3.11 or later.