Spring boot Camel ActiveMQ apache geronimo漏洞

Question

    <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-jms</artifactId>
        <version>${camel.version}</version>
    </dependency>
    <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>artemis-jms-client</artifactId>
    </dependency>
    <dependency>
        <groupId>org.apache.camel</groupId>
        <artifactId>camel-jms-starter</artifactId>
        <version>${camel.version}</version>
    </dependency>

spring.artemis.mode=native
spring.artemis.host=localhost
spring.artemis.port=61616
spring.artemis.user=admin
spring.artemis.password=admin

Answer 1

您可以从artemis-jms-client中显式地排除Apache Geronimo依赖项，例如：

    <dependency>
        <groupId>org.apache.activemq</groupId>
        <artifactId>artemis-jms-client</artifactId>
        <exclusions>
            <exclusion>
               <groupId>org.apache.geronimo.specs</groupId>
               <artifactId>geronimo-jms_2.0_spec</artifactId>
            </exclusion>
        </exclusions>
    </dependency>

然后可以添加对Eclipse JMS API实现的依赖项，例如：

    <dependency>
       <groupId>jakarta.jms</groupId>
       <artifactId>jakarta.jms-api</artifactId>
       <version>2.0.3</version>
    </dependency>

也就是说，Apache Geronimo JMS API被标记为漏洞是非常奇怪的，因为它只是一个API。换句话说，它只是Java接口和空类定义。