[
https://issues.apache.org/jira/browse/JAMES-3593?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Benoit Tellier closed JAMES-3593.
---------------------------------
Resolution: Fixed
We endedup recommending RabbitMQ 3.8.17 as 3.8.16 is affected by undisclosed
CVE.
> Recommand RabbitMQ upgrade - prior 3.8.16 has multiple CVE
> ----------------------------------------------------------
>
> Key: JAMES-3593
> URL: https://issues.apache.org/jira/browse/JAMES-3593
> Project: James Server
> Issue Type: New Feature
> Components: rabbitmq
> Affects Versions: 3.6.0
> Reporter: Benoit Tellier
> Priority: Major
> Fix For: 3.7.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> According to https://www.rabbitmq.com/changelog.html RabbitMQ prior this
> version is subject to several CVE:
> - https://tanzu.vmware.com/security/cve-2020-5419
> - https://tanzu.vmware.com/security/cve-2021-22117
> - https://tanzu.vmware.com/security/cve-2021-22116
> We currently recommend running on `3.8.3`...
> We should:
> - [ ] Test James against RabbitMQ 3.8.16 (update the image in
> apache/james-project and getting a green build is enough)
> - [ ] Recommand the upgrade in update instructions and changelog
> - [ ] Check the documentation
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscr...@james.apache.org
For additional commands, e-mail: server-dev-h...@james.apache.org
