jasypt version 1.9.3 is vulnerable to CVE-2022-22965

[cloudtracer]

Can this dependency be updated? Its vulnerable to a a number of old CVEs some of which are rated high.

[jbonofre]

Already updated: https://github.com/apache/activemq/blob/main/pom.xml#L72

[cloudtracer]

Thanks for the fast response @jbonofre but 1.9.3 is a vulnerable version. You can see all the vulnerabilities with this dependency on mvnrepository : https://mvnrepository.com/artifact/org.jasypt/jasypt-spring4/1.9.3

[jbonofre]

Oh sorry, I thought you asked to update to 1.9.3.

[jbonofre]

Let me do an analyse to see if the CVEs actually applicable in ActiveMQ context.

[davhaus]

Does applicability of a given CVE matter? jasypt is EOL as of last fall with the last release published 7 years ago. That alone is a critical finding in some settings and can only be addressed by outright replacement.

https://github.com/jasypt/jasypt:

...

[mattrpav]

I’m in favor of replacing it. jasypt is such a thin wrapper anyway. More work to maintain it than a simple hash utility

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment if you think it's still relevant.

[davhaus]

Still relevant.

[mattrpav]

I'll try to pull this into 6.4.0 and be done w/ jasypt.