[
https://issues.apache.org/jira/browse/ARTEMIS-2413?focusedWorklogId=720081&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-720081
]
ASF GitHub Bot logged work on ARTEMIS-2413:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 03/Feb/22 12:36
Start Date: 03/Feb/22 12:36
Worklog Time Spent: 10m
Work Description: gemmellr commented on pull request #3934:
URL:
https://github.com/apache/activemq-artemis/pull/3934#issuecomment-1028946718
I think its a decent enough JIRA description (though its not actually on the
JIRA) but not a great commit log. It would be good to say the version it is
upgrading to.
I think the version number jumping from 3 to 5 is clear enough reason in
itself. The first half of the log message could go, maybe leaving just the
initial 'JGroups 3.x hasn't been updated in some time' + 'and has CVEs', and it
would have the same effect. Getting around to the important detail of the
change itself having a potential break effect far earlier seems nicer to me.
Referencing Log4Shell and Log4J in the commit, in a paragraph ending "The
upgrade is meant to deal with all these issues" even seems like an actively bad
thing to do when Log4J isnt involved.
I think many users will tend to find the JIRA (e.g via the release notes
page), which can and should explain things in detail, before they read the
commit log.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscr...@activemq.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 720081)
Time Spent: 50m (was: 40m)
> Upgrade JGroups
> ---------------
>
> Key: ARTEMIS-2413
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2413
> Project: ActiveMQ Artemis
> Issue Type: Task
> Affects Versions: 2.6.4
> Reporter: Endre Jeges
> Priority: Major
> Time Spent: 50m
> Remaining Estimate: 0h
>
> I have noticed with the OWASP dependency-check plugin
> (org.owasp:dependency-check-maven:5.0.0) that the currently used
> org.jgroups:jgroups:3.6.13.Final has a [CWE-300: Channel Accessible by
> Non-Endpoint
> ('Man-in-the-Middle')|https://ossindex.sonatype.org/vuln/7c83fdab-9665-4e79-bc81-cc67fbb96417]
> vulnerability. The problem has not been reported in the NVD database,
> therefore there is no CVE record.
> The vulnerability has been
> [addressed|https://github.com/belaban/JGroups/pull/348] in version
> org.jgroups:jgroups:4.0.2.Final (at the moment the latest version is
> org.jgroups:jgroups:4.1.1.Final).
> The org.jgroups:jgroups dependency would require an upgrade to resolve the
> vulnerability.
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
