Skip to content

Commit 934ef82

Browse files
ayohoayoho
authored
Merge pull request #4767 from OpenLiberty/cve-add
adding cve session and remove repeated content
2 parents ca25c01 + ab69921 commit 934ef82

3 files changed

Lines changed: 83 additions & 2 deletions

File tree

‎posts/2026-01-27-26.0.0.1.adoc‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ In this release, Open Liberty introduces log throttling to automatically suppres
6969
In link:{url-about}[Open Liberty] 26.0.0.1:
7070

7171
* <<logging, Log Throttling>>
72+
* <<CVEs, Security Vulnerability (CVE) Fixes>>
7273
* <<bugs, Notable bug fixes>>
7374

7475
// // // // // // // //
@@ -207,6 +208,29 @@ When `throttleType` is set to `message`, throttling is applied to the entire mes
207208

208209
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
209210

211+
[#CVEs]
212+
== Security vulnerability (CVE) fixes in this release
213+
[cols="5*"]
214+
|===
215+
|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes
216+
217+
|https://www.cve.org/CVERecord?id=CVE-2025-12635[CVE-2025-12635]
218+
|5.4
219+
|Cross-site scripting
220+
|17.0.0.3-25.0.0.12
221+
|Affects the `servlet-3.1`, `servlet-4.0`, `servlet-5.0`, and `servlet-6.0` features
222+
|===
223+
// // // // // // // //
224+
// In the preceding section:
225+
// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz.
226+
// Note: When linking to features, use the
227+
// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and
228+
// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[])
229+
//
230+
// If there are no CVEs fixed in this release, replace the table with:
231+
// "There are no security vulnerability fixes in Open Liberty [RELEASE_VERSION]."
232+
// // // // // // // //
233+
For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list].
210234

211235
[#bugs]
212236
== Notable bugs fixed in this release

‎posts/2026-02-24-26.0.0.2.adoc‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ This release introduces Java Toolchains support, enabling developers to decouple
6767
In link:{url-about}[Open Liberty] 26.0.0.2:
6868

6969
* <<java_toolchains, Java Toolchains in Liberty Build Plugins>>
70+
* <<CVEs, Security Vulnerability (CVE) Fixes>>
7071
* <<bugs, Notable bug fixes>>
7172

7273
View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A26002+label%3A%22release+bug%22[26.0.0.2].
@@ -159,11 +160,10 @@ With Java Toolchains, you can now run your build tool on a modern JDK (for examp
159160

160161
=== Maven Plugin integration
161162

162-
The Liberty Maven plugin now integrates seamlessly with the maven-toolchain-plugin. To use this feature, define your available JDKs in your `~/.m2/toolchains.xml` file. The plugin automatically detects and uses the toolchain that is specified in your project's `pom.xml` file.
163163
The Liberty Maven Plugin now integrates seamlessly with the maven-toolchain-plugin as of version 3.12.0.
164164
To use this feature, define your available JDKs in your `~/.m2/toolchains.xml` file and then configure `<jdkToolchain>` tag in `<configuration>`.
165-
166165
The plugin automatically detects and uses the toolchain specified in your project’s `pom.xml` file.
166+
167167
For detailed configuration steps and parameters, see the link:https://github.com/OpenLiberty/ci.maven/blob/main/docs/toolchain.md[Liberty Maven Plugin Toolchain documentation].
168168

169169
The plugin acknowledges the JDK vendor and version constraints that are defined in your Maven profiles, helping to ensure that your server environment remains consistent across different developer machines and CI/CD pipelines.
@@ -224,6 +224,31 @@ java {
224224

225225
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
226226

227+
[#CVEs]
228+
== Security vulnerability (CVE) fixes in this release
229+
[cols="5*"]
230+
|===
231+
|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes
232+
233+
|https://www.cve.org/CVERecord?id=CVE-2025-14914[CVE-2025-14914]
234+
|7.6
235+
|Remote code execution
236+
|17.0.0.3-26.0.0.1
237+
|Affects the `restConnector-2.0` feature
238+
|===
239+
// // // // // // // //
240+
// In the preceding section:
241+
// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz.
242+
// Note: When linking to features, use the
243+
// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and
244+
// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[])
245+
//
246+
// If there are no CVEs fixed in this release, replace the table with:
247+
// "There are no security vulnerability fixes in Open Liberty [RELEASE_VERSION]."
248+
// // // // // // // //
249+
For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list].
250+
251+
227252
[#bugs]
228253
== Notable bugs fixed in this release
229254

‎posts/2026-03-24-26.0.0.3.adoc‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ In link:{url-about}[Open Liberty] 26.0.0.3:
6868

6969
* <<userregistry, UserRegistry Attribute Reader Enhancement>>
7070
* <<jandex, Jandex Index Format Support Update>>
71+
* <<CVEs, Security Vulnerability (CVE) Fixes>>
7172
* <<bugs, Notable bug fixes>>
7273

7374
View the list of fixed bugs in link:https://github.com/OpenLiberty/open-liberty/issues?q=label%3Arelease%3A26003+label%3A%22release+bug%22[26.0.0.3].
@@ -293,6 +294,37 @@ For more information, see the link:https://smallrye.io/jandex/jandex/3.5.3/index
293294

294295
// DO NOT MODIFY THIS LINE. </GHA-BLOG-TOPIC>
295296

297+
[#CVEs]
298+
== Security vulnerability (CVE) fixes in this release
299+
[cols="5*"]
300+
|===
301+
|CVE |CVSS Score |Vulnerability Assessment |Versions Affected |Notes
302+
303+
|https://www.cve.org/CVERecord?id=CVE-2025-14923[CVE-2025-14923]
304+
|4.7
305+
|Weaker security
306+
|17.0.0.3-26.0.0.2
307+
|
308+
309+
|https://www.cve.org/CVERecord?id=CVE-2024-29371[CVE-2024-29371]
310+
|7.5
311+
|Denial of service
312+
|21.0.0.3-26.0.0.2
313+
|Affects the `openidConnectClient-1.0`, `socialLogin-1.0`, `mpJwt-1.2`, `mpJwt-2.0`, `mpJwt-2.1`, and `jwt-1.0` features
314+
|===
315+
// // // // // // // //
316+
// In the preceding section:
317+
// If there were any CVEs addressed in this release, fill out the table. For the information, reference https://github.com/OpenLiberty/docs/blob/draft/modules/ROOT/pages/security-vulnerabilities.adoc. If it has not been updated for this release, reach out to Kristen Clarke or Michal Broz.
318+
// Note: When linking to features, use the
319+
// `link:{url-prefix}/docs/latest/reference/feature/someFeature-1.0.html[Some Feature 1.0]` format and
320+
// NOT what security-vulnerabilities.adoc does (feature:someFeature-1.0[])
321+
//
322+
// If there are no CVEs fixed in this release, replace the table with:
323+
// "There are no security vulnerability fixes in Open Liberty [RELEASE_VERSION]."
324+
// // // // // // // //
325+
For a list of past security vulnerability fixes, reference the link:{url-prefix}/docs/latest/security-vulnerabilities.html[Security vulnerability (CVE) list].
326+
327+
296328
[#bugs]
297329
== Notable bugs fixed in this release
298330

0 commit comments

Comments
 (0)