Security vulnerabilities in Axis2 dependencies? "tribes" & "juli" JAR files

 Hi

Sorry if you are getting this mail twice, but I sent it before having
finished subscribing, so I was unsure if it reached the list.

We have recently integrated the OWASP Dependency Checker into our CI-setup,
and it has flagged two libraries as potentially problematic (i.e. affected
by serious CVE's), namely tribes-6.0.16.jar & juli-6.0.16.jar. It turns out
those are actually dependencies for Axis2. Both JAR files seem to be part
of Tomcat 6. Question is, how should we react to this finding? Are the
CVE's for those libraries not relevant when used in the context of Axis2,
since they haven't been updated(the latest version of Axis2 still ships
those versions)?

Thanks!

BR, Martin

---

Dependency CPE Coordinates Highest Severity CVE Count↓ CPE Confidence Evidence
Count

tribes-6.0.16.jar cpe:/a:apache:tomcat:6.0.16
cpe:/a:apache_software_foundation:tomcat:6.0.16
cpe:/a:apache_tomcat:apache_tomcat:6.0.16 org.apache.tomcat:tribes:6.0.16 ✓
High 66 Highest 18


juli-6.0.16.jar cpe:/a:apache:tomcat:6.0.16
cpe:/a:apache_software_foundation:tomcat:6.0.16
cpe:/a:apache_tomcat:apache_tomcat:6.0.16 org.apache.tomcat:juli:6.0.16 ✓
High 66 Highest 16