CVE-2011-5034 on geronimo

[mkaminskimichal]

Please update the Geronimo dependency to >2.2.1 to remove vulnerability

[maksymgrydz]

Guys, any updates regarding this issue?

[vghero]

Same here. We're using anchore to scan our builds and it is showing the vulnerability too.

[simonDeHero]

i would like to "bump" that :-)

[volkanto]

👍

[ziyanli-amazon]

Will look into this shortly

[ziyanli-amazon]

Upon checking, looks like our JMS repo depends on org.apache.geronimo.specs » geronimo-jms_1.1_spec. While i don't have access to geronimo-jms repo, do we know how to upgrade to 2.2.x in this case?

[volkanto]

I found this regarding the issue, maybe can help?

[vghero]

I checked the geronimo spec jar file and there are mainly interfaces in there. Additionally exceptions and two actual classes namely QueueRequestor and TopicRequestor. But their impl is minimal. So I would agree, that this is not about the spec being vulnerable, but some of the servers implementing it - which are named in the related CVEs (Geronimo, Glassfish etc.).

So either one could ignore this false positive on the scanner or one could try to use a different JMS 1.1 API jar like this one.

I compared both jars and filename and counts are identical (class/package wise). I even extracted method signatures of all class files and compared them. All are identical except the mentioned two *Requestors. They differ in package private field vs. private fields. As this should not matter in a spec, I would say it should be a drop-in replacement. WDYT?

I also saw this here (without -rev1), but sadly trying to fetch the jar results in 404.

To see by yourself, simply extract those jars into separate dirs and do

for i in * ; do javap $i > $i.txt; done

Then delete the .classes and compare both javax/jms dirs with your favourite compare tool.

[ziyanli-amazon]

Thanks for the diving deep @vghero !! Very insightful info. I can try to have us on this. WDYT?

<dependency>
    <groupId>javax.jms</groupId>
    <artifactId>jms-api</artifactId>
    <version>1.1-rev-1</version>
</dependency>

[vghero]

Yeah looks good. Triplechecked what the Spring guys were using with their 4.3.x version for spring-jms. They use the same. So good to go I would say :grin:.

For JMS 2.x they use https://mvnrepository.com/artifact/jakarta.jms/jakarta.jms-api meanwhile.

[ziyanli-amazon]

Thanks @vghero I have pushed the changes for both v1 and master branch. Will credit you in the release