[TOMEE-4127] CXF 3.5.5

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.0.0.RC1
• Fix Version/s: 9.0.0
• Component/s: TomEE Core Server
• Assignee: Richard Zowalla
• Reporter: Richard Zowalla
• Created: 15/Dec/22 06:42
• Updated: 19/Dec/22 09:14
• Resolved: 19/Dec/22 09:14

Description

December 13, 2022 - Apache CXF 3.5.5 and 3.4.10 released!
The Apache CXF team is proud to announce the availability of our latest patch releases! Over 9 JIRA issues were fixed for 3.5.5 and 3.4.10. Two new CVEs were issued for vulnerabilities fixed in these releases:

CVE-2022-46363: Apache CXF directory listing / code exfiltration
CVE-2022-46364: Apache CXF SSRF Vulnerability

Issue Links

• is related to: TOMEE-4125 Update Apache CXF versions to mitigate CVE-2022-46364 and CVE-2022-46363
• links to: GitHub Pull Request #988