https://bugzilla.redhat.com/show_bug.cgi?id=1357929
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |aileenc(a)redhat.com,
| |chazlett(a)redhat.com,
| |drieden(a)redhat.com,
| |ggaughan(a)redhat.com,
| |gmalinko(a)redhat.com,
| |janstey(a)redhat.com,
| |jwon(a)redhat.com
--- Comment #5 from Jonathan Christison <jochrist(a)redhat.com> ---
Marking Red Hat JBoss Fuse 6 and Red Hat Fuse 7 as not affected, although
versions before the documentation update
(
https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b8...)
where shipped at the time there is no use direct usage of
org.springframework.remoting.httpinvoker.*
This was fixed upstream by detailing HttpInvoker endpoints should not be
exposed to untrusted clients, these upstream changes would of been included
with Fuse 6.3 R5 (
https://access.redhat.com/errata/RHSA-2017:3115) which
included a version change to 3.2.18 (3.2.17 containing the documentation fix)
--
You are receiving this mail because:
You are on the CC list for the bug.