[epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs)

[natechadwick-intsof]

Summary — EPIC

OWASP dependency-check on the main branch (Java 1.8 build target) reports 657 CVE matches across 136 unique Maven GAVs. After the Tier 1 Java-1.8-bumpable set (19 GAVs, 153 CVEs) is closed, 117 GAVs (504 CVEs) remain unfixed. This epic tracks the remaining work.

Java 11+ migration is explicitly out of scope for the main branch. The mitigations in this issue are Java 1.8-compatible by design.

How the GAVs break down

Subset	GAVs	CVEs	Why
Tier 2 — fix only in a newer major that requires Java 11+/17+	17	142	Spring 6.x, Bouncy Castle 1.78+, Apache Tika 3.x, CXF 3.6.x, ActiveMQ 5.19.x, Shiro 2.x, Spring 6.x, jackrabbit 2.22.x, etc.
Tier 3 — at the latest Java 1.8 line; no Java 1.8 fix exists	100	362	Maintainer dropped Java 1.8 from the support matrix. Examples: xstream 1.4.21, spring-security 5.8.16, jetty 9.4.58, commons-compress 1.28.0, pdfbox 2.0.31, tika 2.9.4, log4j 2.25.3, hibernate 5.6.15.Final, snakeyaml 2.6.
EOL with no fix ever	(subset of Tier 3)	—	commons-lang 2.6, commons-collections 3.2.2, commons-beanutils 1.11.0, commons-httpclient 3.1, commons-configuration 1.10, commons-fileupload 1.6.0, jasypt 1.9.3, bsh 2.0b6, jtds 1.3.1, sanselan 0.97-incubator, axis 1.4.x, jettison 1.5.4, json-lib 2.4, rhino 1.7.15.1, shindig 1.1-BETA5-incubating, soap 2.3.1. These need library replacement, not just configuration hardening.

A per-GAV table for all 117 is in docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json (keys UPGRADE_REQUIRES_NEWER_JAVA and NO_JAVA8_UPGRADE).

Sub-tasks to be opened under this epic

Each child issue should track one mitigation pattern and reference the relevant GAVs from the analysis.

• [ ] T2.1 — Apache Tika 2.9.x hardening (13 CVEs in tika-core + 2 in tika-parser-pdf-module)

  • Restrict Tika to a strict AutoDetectParser with an explicit Detector / Parser map (reject unexpected types).
  • Process untrusted uploads in a separate JVM with restricted FS / network (sandbox).
  • Rate-limit PDF parsing operations.
  • Strip embedded scripts / OLE objects before invoking the parser.
  • Track the Java 1.8 compatibility of future Tika 2.9.x patches; if any ship, backport.

• [ ] T2.2 — ActiveMQ 5.16.x hardening (30 CVEs across activemq-client / broker / openwire-legacy)

  • Change <transportConnectors> in activemq.xml from tcp://0.0.0.0:61616 to tcp://127.0.0.1:61616 (or a private interface).
  • Set advisorySupport=false, producerFlowControl=false (where applicable), openwire.tcp.maxFrameSize=100MB.
  • Remove the OpenWire legacy transport connector if unused.
  • Consider migrating to RabbitMQ in a future major release.

• [ ] T2.3 — Apache CXF 3.5.x hardening (13+ CVEs across cxf-core / cxf-rt-frontend-jaxrs / cxf-rt-transports-http)

  • Disable WS-Security unless required (remove WSS4JInInterceptor / WSS4JOutInterceptor from the bus config).
  • Set MessageSizeValidation limits on inbound chains.
  • Apply strict schema validation on all incoming SOAP / XML.

• [ ] T2.4 — Spring Framework 5.3.x + Spring Security 5.8.x hardening (45+ CVEs combined)

  • Apply the Spring 5.3.x security advisory index patches: RFD, open redirects, content-type confusion.
  • Set spring.mvc.contentnegotiation.favor-path-extension=false and use-fresh-handler=true in application.properties / rhythmyx.properties.
  • For @ResponseBody methods, return ResponseEntity<Resource> with Content-Disposition: attachment; filename="...".
  • Spring Security 5.8: ensure CSRF is enabled (default in 5.8+), headers().defaultsDisabled(), SessionManagementFilter configured, DelegatingPasswordEncoder in use, no jsr250 enabled.

• [ ] T2.5 — XStream 1.4.21 hardening (37 CVEs)

  • For every XStream instance: call setupDefaultSecurity() and XStream.addPermission(NoTypePermission.NONE), then grant per-class permissions.
  • Never accept untrusted XML directly; use Jackson (already in project) or JAXB instead.
  • Document: XStream is a deserialization surface; treat any XStream.fromXML on untrusted input as RCE.

• [ ] T2.6 — Apache Commons hardening (commons-compress, commons-text, commons-email, commons-collections4, commons-collections, commons-beanutils, commons-lang, commons-httpclient, commons-configuration, commons-fileupload, commons-io)

  • commons-compress 1.28.0 (11 CVEs): validate archive entries before extraction; reject .. paths; set ZipFile.setMaxEntrySize().
  • commons-text 1.15.0 (1 CVE): the CVE is in StringSubstitutor; never substitute into user input.
  • commons-email 1.6.0 (2 CVEs): validate all email headers and recipient lists.
  • commons-collections4 4.5.0 (2 CVEs): input validation on any Transformer / Predicate / Closure chain.
  • commons-collections 3.2.2 (2 CVEs): EOL — migrate to commons-collections4 (already in project). Replace org.apache.commons.collections.* → org.apache.commons.collections4.*.
  • commons-beanutils 1.11.0 (3 CVEs): EOL — migrate to commons-beanutils2 (Jakarta) or Spring BeanUtils.
  • commons-lang 2.6 (1 CVE): EOL — migrate to commons-lang3 (already in project). Replace org.apache.commons.lang.* → org.apache.commons.lang3.*.
  • commons-httpclient 3.1 (1 CVE): EOL since 2007 — migrate to Apache HttpClient 4.x or 5.x (already in project).
  • commons-configuration 1.10 (1 CVE): EOL — migrate to commons-configuration2.
  • commons-fileupload 1.6.0 (7 CVEs): EOL — set strict multipart.maxFileSize / multipart.maxRequestSize; migrate to commons-fileupload2 (Jakarta) or Spring MultipartResolver.
  • commons-io 2.21.0 (2 CVEs): on latest 2.21 line; CVE around untrusted file paths. Validate all paths before FileUtils / IOUtils operations.

• [ ] T2.7 — Apache Tomcat 9.0.x hardening (1 CVE in tomcat-juli, 1 in tomcat-servlet-api)

  • Disable AJP connector unless required (CVE-2020-1938).
  • Set allowedRequestAttributesPattern strict.
  • Follow Tomcat 9 hardening guide.

• [ ] T2.8 — Apache Log4j 2.25.x hardening (13 CVEs across log4j-core, log4j-api, log4j-1.2-api)

  • Set log4j2.formatMsgNoLookups=true defensively.
  • Don't include user data in log message patterns.
  • Restrict log destinations if log data is sensitive.

• [ ] T2.9 — Apache PDFBox 2.0.31 hardening (8 CVEs)

  • Set org.apache.pdfbox.rendering.UsePureJavaCMYKConversion=true.
  • Limit untrusted PDF processing; sandbox where possible.
  • Plan migration to PDFBox 3.x when the project moves to Java 11+.

• [ ] T2.10 — Apache POI 5.2.x hardening (7+ CVEs across poi-core, poi-ooxml, poi-scratchpad)

  • Reject untrusted Office files.
  • Sandbox POI processing; consider Apache Tika for parsing user uploads.

• [ ] T2.11 — SnakeYAML 2.6 + 1.23 hardening (8 + 8 CVEs)

  • Use SafeConstructor; never pass Constructor to untrusted YAML.
  • Set LoaderOptions.setAllowUnknownTags(false).
  • Cap input size.

• [ ] T2.12 — Xerces 2.12.2 hardening (5 CVEs)

  • Set http://apache.org/xml/features/disallow-doctype-decl=true and other safe-features.
  • Disable external entities.

• [ ] T2.13 — Eclipse Jetty 9.4.58 hardening (29 + 1 + 3 + 2 CVEs across jetty-server, jetty-util, jetty-http2-*)

  • Set HttpConfiguration.setSendServerVersion(false), max header size, request attribute pattern.
  • Disable HTTP/2 if not needed: remove the http2-* modules from the assembly.
  • Follow Jetty 9.4 hardening guide.

• [ ] T2.14 — Hibernate 5.6.x + Hibernate Validator 6.2.x hardening (3 + 4 CVEs)

  • Use HQL parameter binding; never build HQL from user input.
  • Disable message interpolation in ConstraintValidator for user-controlled messages.

• [ ] T2.15 — MyFaces 2.3.11 hardening (2 CVEs)

  • Disable ViewState compression if not required; set org.apache.myfaces.SECRET to a strong value; enable strict_jar_in_filesystem.

• [ ] T2.16 — OWASP AntiSamy 1.7.8 + ESAPI 2.7.0 hardening (7 + 7 CVEs)

  • Update the AntiSamy policy file to the latest rules.
  • Set strong master key + salt for ESAPI; rotate; ESAPI 2.x is in maintenance mode.

• [ ] T2.17 — Library replacements for EOL dependencies (15+ artifacts)

  • jasypt 1.9.3 → Spring Security Crypto (BCryptPasswordEncoder / SCryptPasswordEncoder / StandardPasswordEncoder PBKDF2). CVE-2023-24 is a timing attack on PBE.
  • bsh 2.0b6 → JEXL or Groovy. RCE in BeanShell 2.0b6.
  • jtds 1.3.1 → Microsoft's official mssql-jdbc (already in project).
  • sanselan 0.97-incubator → Apache Commons Imaging.
  • axis 1.4.x → CXF (already in project) or JAX-WS RI. If migration impossible: restrict to localhost, disable unused RPC handlers via server-config.wsdd.
  • jettison 1.5.4 → Jackson (already in project).
  • json-lib 2.4 → Jackson (already in project).
  • rhino 1.7.15.1 → GraalVM JavaScript or Nashorn (JDK 8 has Nashorn built-in).
  • shindig 1.1-BETA5-incubating → review whether this is still in use; if not, remove. If yes, replace with a current gadget container (no Java 1.8 option exists; consider removing gadgets).
  • soap 2.3.1 → JAX-WS RI (jakarta.xml.ws:jaxws-api or javax.xml.ws:jaxws-api).
  • rhino 1.7.15.1 → JDK Nashorn (built-in) or GraalVM.

• [ ] T2.18 — Apache Derby 10.14.2.x hardening (7 CVEs)

  • Bind only to localhost or private interface.
  • Enable authentication (derby.user.*) and SSL.

• [ ] T2.19 — Spring LDAP 2.4.4 hardening (3 CVEs)

  • Validate all DN inputs to prevent LDAP injection.
  • Use LdapTemplate with parameterized queries.

• [ ] T2.20 — Other minor deps (commons-net 3.12.0, dom4j 2.1.5, jdom 2.0.6.1, jaxen, json 2025-12-24, etc.)

  • See the full per-GAV table in categorized-final.json under NO_JAVA8_UPGRADE for the complete list of 100 GAVs.

Acceptance criteria

• For each sub-task: the GAVs listed in the sub-task are documented as mitigated in SECURITY.md (or in a new docs/SECURITY-MITIGATIONS.md).
• For each sub-task: the OWASP dependency-check suppression XML (owasp-suppressions.xml) records the specific CVE + GAV + mitigation, with a notes field describing the mitigation. No broad "suppress everything" entries.
• For each EOL replacement (T2.17): the replacement library is in use, the old GAV no longer appears in the dependency graph, and any call sites have been migrated.

Out of scope

• Java 11+ migration. The main branch stays on Java 1.8. A future major branch may tackle the migration; the Tier 2 GAVs in this issue would then be closed by that move.

References

• Full analysis: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/main-vulnerability-report.md
• Machine-readable per-GAV data: docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json (keys UPGRADE_REQUIRES_NEWER_JAVA and NO_JAVA8_UPGRADE)
• Per-module OWASP HTML reports at <module>/target/dependency-check-report.html
• Parent task (the 19 GAVs that CAN be upgraded on Java 1.8): see related issue in this milestone.