CODEWITHSUNDEEP
javaactivemq-classic
user1591156
user1591156

Reputation: 1995

ActiveMQ version 5.16.0 has vulnerable dependency jar

I am using ActiveMQ 5.16.0 downloaded from Apache. I see a few of the jars are older versions which have vulnerabilities, e.g.:

  1. com.google.guava_guava 19.0
  2. core_jackson-databind 2.9.10.4
  3. shiro-core 1.5.3
  4. log4j-1.2.17

I see all above vulnerable jars are located under apache-activemq-5.16.0\lib\optional\. What is use of jars under the optional directory? Is there any latest release of ActiveMQ which has all latest dependencies?

Upvotes: 0

Views: 1280

Answers (1)

ShadowOfLies
ShadowOfLies

Reputation: 130

Optional dependencies are just that: Optional.

Using Shiro in your case as reference.

Optional Dependencies: Typically an optional dependency is not required for the core functionality of the library you are referencing. In this case, Shiro is only required if you intend to make use of Apache Shiro features or functionality. Shiro is used for security and therefore makes sense that it will not be used by everyone making use of ActiveMQ.

Versions: Many times (not always) optional dependency versions are not set in stone and it may be possible to use newer versions without breaking the functionality. This is not always the case, so if you aim to do this, start with the preferred version and only upgrade after the functionality is working to test.

Vulnerabilities: Simply because a vulnerability exists, does not make it applicable to your use case. Just because there is a known vulnerability in a dependency that can do XYZ, it will likely not affect you if your use case does not make use of XYZ. A security report such as the Apache Shiro one could help in understanding this.

Additionally: I would suggest that you look into Maven or Gradle for your Java projects. This will take away some of the need to worry about these types of dependency management issues as optional dependecies are not included in the dependecy hierarchy by default.

Upvotes: 1

Related Questions