From d49598df7558cea3dcc72c97b7bf119f4b59d0fc Mon Sep 17 00:00:00 2001 From: Tobias Liefke Date: Mon, 14 Sep 2026 19:29:14 +0200 Subject: [PATCH] Improve GHSA-93g8-qqv3-mrx8 --- .../GHSA-93g8-qqv3-mrx8.json | 23 +++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json b/advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json index cb3ecb023437..05d0366b9bf0 100644 --- a/advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json +++ b/advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json @@ -7,7 +7,7 @@ "CVE-2026-50632" ], "summary": "Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory", - "details": "A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.", + "details": "A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.", "severity": [ { "type": "CVSS_V3", @@ -44,7 +44,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "4.0.0" }, { "fixed": "4.1.7" @@ -52,6 +52,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-rt-transports-jms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.12" + } + ] + } + ] } ], "references": [