CVE-2016-3088

COURTAULT Francois <[email protected]>
Newsgroups gmane.comp.java.openejb.user
Message-ID <MR1P264MB235547E3E79DD52D386764E89DCC9__49904.5338643313$1674842791$gmane$org@MR1P264MB2355.FRAP264.PROD.OUTLOOK.COM> 
Hello everyone,

We scan the vulnerabilities in TomEE Plus 8.0.14 and we have discovered the following CVE: CVE-2016-3088 which prevent us to use this version :(
It seems it is due to activemq-protobuf-1.1.jar.

The question: Is the ActiveMQ Fileserver web application deployed in TomEE 8.0.14 and TomEE 9.0.0 ?
If not the CVE-2016-3088 doesn't affect TomEE 8.0.14 and 9.0.0, right ?

Best Regards.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.