[GovWayCore]

Risolta la seguente vulnerabilità relative ai jar di terza parte: - CVE-2025-23184: aggiornata libreria 'org.apache.cxf:*' alla versione 3.6.5 aggiornata libreria 'org.ow2.asm:asm' alla versione 9.7.1
link-it · Jan 22, 2025 · 7728d5c · 7728d5c
1 parent 371b44b
commit 7728d5c
Show file tree

Hide file tree

Showing 44 changed files with 104 additions and 58 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,12 @@
+2025-01-22  Andrea Poli <[email protected]>
+
+	* [GovWayCore]
+	Risolto Bug #1567
+	Risolta la seguente vulnerabilità relative ai jar di terza parte:
+	- CVE-2025-23184: 
+		aggiornata libreria 'org.apache.cxf:*' alla versione 3.6.5
+		aggiornata libreria 'org.ow2.asm:asm' alla versione 9.7.1
+
 2025-01-21  Andrea Poli <[email protected]>
 
 	* [GovWayCore]

diff --git a/core/ant/openspcoop2-ear.xml b/core/ant/openspcoop2-ear.xml
@@ -28,9 +28,9 @@
 		<var name="tmp" value="${tmp} ${tmp_prefix}/commons-io-2.15.1.jar"/>
 		<var name="tmp" value="${tmp} ${tmp_prefix}/commons-lang-2.6.jar"/>
 		<var name="tmp" value="${tmp} ${tmp_prefix}/commons-net-3.9.0.jar"/>
-		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-core-3.6.4-gov4j-1.jar"/>
-		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-rt-bindings-soap-3.6.4.jar"/>
-		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-rt-ws-security-3.6.4.jar"/>
+		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-core-3.6.5-gov4j-1.jar"/>
+		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-rt-bindings-soap-3.6.5.jar"/>
+		<var name="tmp" value="${tmp} ${tmp_prefix}/cxf-rt-ws-security-3.6.5.jar"/>
 		<var name="tmp" value="${tmp} ${tmp_prefix}/jaxb-api-2.3.1.jar"/>
 		<var name="tmp" value="${tmp} ${tmp_prefix}/jaxb-core-2.3.0.1.jar"/>
 		<var name="tmp" value="${tmp} ${tmp_prefix}/jaxb-impl-2.3.7.jar"/>

diff --git a/example/pdd/server/testService/build.xml b/example/pdd/server/testService/build.xml
@@ -201,7 +201,7 @@
 			<lib dir="${libs}/cxf">
 				<include name="cxf-core-*.jar" />
 				<include name="cxf-rt-*.jar" />
-				<exclude name="cxf-rt-transports-http-3.6.4.jar" /> <!-- warning su wildfly al deploy -->
+				<exclude name="cxf-rt-transports-http-3.6.5.jar" /> <!-- warning su wildfly al deploy -->
 				<include name="jakarta.ws.rs-api-2.1.6.jar" />
 			</lib>
 			<lib dir="${libs}/saaj">

diff --git a/lib/openspcoop2.userlibraries b/lib/openspcoop2.userlibraries
@@ -26,32 +26,32 @@
 	<archive path="/op2_3.3.dev/lib/commons/commons-compress-1.26.0.jar"/>
 	<archive path="/op2_3.3.dev/lib/commons/commons-math3-3.6.1.jar"/>
 	<!-- cxf -->
-        <archive path="/op2_3.3.dev/lib/cxf/cxf-core-3.6.4-gov4j-1.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-bindings-soap-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-databinding-jaxb-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-features-logging-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-simple-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-jaxws-3.6.4.jar" />
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-jaxrs-3.6.4.jar" />
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-security-3.6.4.jar" />
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-security-saml-3.6.4.jar" />
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-transports-http-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-transports-http-jetty-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-json-basic-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-security-jose-3.6.4-gov4j-1.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-security-jose-jaxrs-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-common-openapi-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-openapi-v3-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-swagger-ui-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-wsdl-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-ws-policy-3.6.4.jar" />
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-ws-security-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-common-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-validator-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-core-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-databinding-jaxb-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-frontend-jaxws-3.6.4.jar"/>
-	<archive path="/op2_3.3.dev/lib/cxf/asm-9.7.jar"/>
+        <archive path="/op2_3.3.dev/lib/cxf/cxf-core-3.6.5-gov4j-1.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-bindings-soap-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-databinding-jaxb-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-features-logging-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-simple-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-jaxws-3.6.5.jar" />
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-frontend-jaxrs-3.6.5.jar" />
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-security-3.6.5.jar" />
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-security-saml-3.6.5.jar" />
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-transports-http-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-transports-http-jetty-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-json-basic-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-security-jose-3.6.5-gov4j-1.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-security-jose-jaxrs-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-common-openapi-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-openapi-v3-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-rs-service-description-swagger-ui-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-wsdl-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-ws-policy-3.6.5.jar" />
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-rt-ws-security-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-common-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-validator-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-core-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-databinding-jaxb-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/cxf-tools-wsdlto-frontend-jaxws-3.6.5.jar"/>
+	<archive path="/op2_3.3.dev/lib/cxf/asm-9.7.1.jar"/>
 	<archive path="/op2_3.3.dev/lib/cxf/jakarta.ws.rs-api-2.1.6.jar"/>
         <archive path="/op2_3.3.dev/lib/cxf/stax2-api-4.2.2.jar"/>
         <archive path="/op2_3.3.dev/lib/cxf/woodstox-core-6.6.2.jar"/>

diff --git a/mvn/dependencies/cxf/pom.xml b/mvn/dependencies/cxf/pom.xml
@@ -17,9 +17,9 @@
 
 		<jar.group.name>cxf</jar.group.name>
 
-		<asm.version>9.7</asm.version>
-		<cxf.version>3.6.4</cxf.version>
-		<cxf.gov4j.version>3.6.4-gov4j-1</cxf.gov4j.version>
+		<asm.version>9.7.1</asm.version>
+		<cxf.version>3.6.5</cxf.version>
+		<cxf.gov4j.version>3.6.5-gov4j-1</cxf.gov4j.version>
 		<javax.ws.rs.api.cxf.version>2.1.6</javax.ws.rs.api.cxf.version>
 		<stax2.api.version>4.2.2</stax2.api.version>
 		<woodstock.core.version>6.6.2</woodstock.core.version>

diff --git a/mvn/dependencies/owasp/falsePositives/CVE-2022-40705.xml b/mvn/dependencies/owasp/falsePositives/CVE-2022-40705.xml
@@ -1,7 +1,7 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
   <suppress>
      <notes><![CDATA[
-     file name: cxf-rt-bindings-soap-3.6.4.jar
+     file name: cxf-rt-bindings-soap-3.6.5.jar
      La vulnerabilità 'CVE-2022-40705' è relativa alla libreria 'soap:soap' e non a CXF.
      Evidenze disponibili in:
      - https://nvd.nist.gov/vuln/detail/CVE-2022-40705 (This issue affects Apache SOAP version 2.2 and later versions)

diff --git a/pom.xml b/pom.xml
@@ -34,7 +34,7 @@
 
 		<!-- owasp config -->
 		<owasp>verify</owasp> <!-- owasp phase, use 'none' for disable -->
-		<owasp.plugin.version>12.0.0</owasp.plugin.version>
+		<owasp.plugin.version>12.0.1</owasp.plugin.version>
 		<owasp.plugin.autoUpdate>true</owasp.plugin.autoUpdate> <!-- Impostare a false quando ci sono problemi su repository NIST -->
 		<owasp.plugin.failBuildOnAnyVulnerability>false</owasp.plugin.failBuildOnAnyVulnerability>
 		<owasp.ossindex.prevents429.sleep>5</owasp.ossindex.prevents429.sleep> <!-- https://github.com/sonatype/ossindex-maven/issues/17 -->

diff --git a/protocolli/modipa/testsuite/build.xml b/protocolli/modipa/testsuite/build.xml
@@ -46,7 +46,7 @@
 			<include name="joda-time-2.12.0.jar"/>
                 </fileset>
                 <fileset dir="${required_lib}/cxf" >
-                        <include name="asm-9.7.jar"/>
+                        <include name="asm-9.7.1.jar"/>
                 </fileset>
                 <fileset dir="${openspcoop2.dist}" >
                         <include name="*.jar"/>

diff --git a/protocolli/spcoop/example/registroServizi/wsdl/build.xml b/protocolli/spcoop/example/registroServizi/wsdl/build.xml
@@ -58,17 +58,17 @@
 		<fileset dir="${required_lib}/log" includes="*.jar"/>
 		<fileset dir="${required_lib}/shared" includes="wsdl4j-1.6.3.jar"/>
 		<fileset dir="${required_lib}/shared" includes="velocity-engine-core-2.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-tools-validator-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-core-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-frontend-jaxws-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-databinding-jaxb-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-tools-common-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-core-3.6.4-gov4j-1.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-rt-wsdl-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-rt-frontend-jaxws-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-rt-frontend-simple-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-rt-databinding-jaxb-3.6.4.jar"/>
-		<fileset dir="${required_lib}/cxf" includes="cxf-rt-bindings-soap-3.6.4.jar"/>	
+		<fileset dir="${required_lib}/cxf" includes="cxf-tools-validator-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-core-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-frontend-jaxws-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-tools-wsdlto-databinding-jaxb-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-tools-common-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-core-3.6.5-gov4j-1.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-rt-wsdl-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-rt-frontend-jaxws-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-rt-frontend-simple-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-rt-databinding-jaxb-3.6.5.jar"/>
+		<fileset dir="${required_lib}/cxf" includes="cxf-rt-bindings-soap-3.6.5.jar"/>	
 		<fileset dir="${required_lib}/cxf" includes="stax2-api-4.2.2.jar"/>
 		<fileset dir="${required_lib}/cxf" includes="woodstox-core-6.6.2.jar"/>
 		<fileset dir="${required_lib}/cxf" includes="xmlschema-core-2.3.1.jar"/>

diff --git a/protocolli/trasparente/testsuite/karate/build.xml b/protocolli/trasparente/testsuite/karate/build.xml
@@ -68,7 +68,7 @@
 			<include name="cxf-core-*.jar"/>
 			<include name="cxf-rt-rs-json-basic-*.jar"/>
 			<include name="cxf-rt-rs-security-jose-*.jar"/>
-			<include name="asm-9.7.jar"/>
+			<include name="asm-9.7.1.jar"/>
 			<include name="woodstox-core-6.6.2.jar"/>
 			<include name="xmlschema-core-2.3.1.jar"/>
 		</fileset>

diff --git a/...c/src/manuali/vulnerability-management/securityAdvisory/2025/CVE-2024-38827.rst b/...c/src/manuali/vulnerability-management/securityAdvisory/2025/CVE-2024-38827.rst
@@ -1,4 +1,4 @@
-.. _vulnerabilityManagement_securityAdvisory_2024_CVE-2024-38827:
+.. _vulnerabilityManagement_securityAdvisory_2025_CVE-2024-38827:
 
 CVE-2024-38827
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -15,7 +15,7 @@ Riferimenti:
 - `https://ossindex.sonatype.org/vulnerability/CVE-2024-38827 <https://ossindex.sonatype.org/vulnerability/CVE-2024-38827>`_
 - `https://spring.io/security/cve-2024-38827 <https://spring.io/security/cve-2024-38827>`_
 
-Libreria: org.springframework.security/spring-security-\* < 5.8.16
+Libreria: org.springframework.security:spring-security-\* < 5.8.16
 
 **Descrizione**
 

diff --git a/...c/src/manuali/vulnerability-management/securityAdvisory/2025/CVE-2025-23184.rst b/...c/src/manuali/vulnerability-management/securityAdvisory/2025/CVE-2025-23184.rst
@@ -0,0 +1,35 @@
+.. _vulnerabilityManagement_securityAdvisory_2025_CVE-2025-23184:
+
+CVE-2025-23184
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Data: 2025-01-22
+
+Severity: Medium
+
+CVSS Score:  5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
+
+Riferimenti:  
+
+- `https://nvd.nist.gov/vuln/detail/CVE-2025-23184 <https://nvd.nist.gov/vuln/detail/CVE-2025-23184>`_
+- `https://ossindex.sonatype.org/vulnerability/CVE-2025-23184 <https://ossindex.sonatype.org/vulnerability/CVE-2025-23184>`_
+- `https://cxf.apache.org/security-advisories.data/CVE-2025-23184.txt <https://cxf.apache.org/security-advisories.data/CVE-2025-23184.txt?version=2&modificationDate=1737381863000&api=v2>`_
+
+Libreria: org.apache.cxf:cxf-core < 3.6.5
+
+**Descrizione**
+
+CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
+
+A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. 
+
+In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
+
+**GovWay**
+
+Versione affette: <= 3.3.15.p2
+
+Risoluzione: prima versione in rilascio
+
+
+
diff --git a/resources/doc/src/manuali/vulnerability-management/securityAdvisory/2025/index.rst b/resources/doc/src/manuali/vulnerability-management/securityAdvisory/2025/index.rst
@@ -3,9 +3,11 @@
 Avvisi di Sicurezza 2025
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-- :ref:`vulnerabilityManagement_securityAdvisory_2024_CVE-2024-38827`
+- :ref:`vulnerabilityManagement_securityAdvisory_2025_CVE-2025-23184`
+- :ref:`vulnerabilityManagement_securityAdvisory_2025_CVE-2024-38827`
 
 .. toctree::
         :maxdepth: 2
 
+	CVE-2025-23184
 	CVE-2024-38827
diff --git a/third-party-licenses/cxf/asm-9.7/asm.txt → third-party-licenses/cxf/asm-9.7.1/asm.txt b/third-party-licenses/cxf/asm-9.7/asm.txt → third-party-licenses/cxf/asm-9.7.1/asm.txt
diff --git a/...censes/cxf/cxf-core-3.6.4-gov4j-1/LICENSE → ...censes/cxf/cxf-core-3.6.5-gov4j-1/LICENSE b/...censes/cxf/cxf-core-3.6.4-gov4j-1/LICENSE → ...censes/cxf/cxf-core-3.6.5-gov4j-1/LICENSE
diff --git a/...es/cxf/cxf-rt-bindings-soap-3.6.4/LICENSE → ...es/cxf/cxf-rt-bindings-soap-3.6.5/LICENSE b/...es/cxf/cxf-rt-bindings-soap-3.6.4/LICENSE → ...es/cxf/cxf-rt-bindings-soap-3.6.5/LICENSE
diff --git a/...cxf/cxf-rt-databinding-jaxb-3.6.4/LICENSE → ...cxf/cxf-rt-databinding-jaxb-3.6.5/LICENSE b/...cxf/cxf-rt-databinding-jaxb-3.6.4/LICENSE → ...cxf/cxf-rt-databinding-jaxb-3.6.5/LICENSE
diff --git a/...cxf/cxf-rt-features-logging-3.6.4/LICENSE → ...cxf/cxf-rt-features-logging-3.6.5/LICENSE b/...cxf/cxf-rt-features-logging-3.6.4/LICENSE → ...cxf/cxf-rt-features-logging-3.6.5/LICENSE
diff --git a/...s/cxf/cxf-rt-frontend-jaxrs-3.6.4/LICENSE → ...s/cxf/cxf-rt-frontend-jaxrs-3.6.5/LICENSE b/...s/cxf/cxf-rt-frontend-jaxrs-3.6.4/LICENSE → ...s/cxf/cxf-rt-frontend-jaxrs-3.6.5/LICENSE
diff --git a/...s/cxf/cxf-rt-frontend-jaxws-3.6.4/LICENSE → ...s/cxf/cxf-rt-frontend-jaxws-3.6.5/LICENSE b/...s/cxf/cxf-rt-frontend-jaxws-3.6.4/LICENSE → ...s/cxf/cxf-rt-frontend-jaxws-3.6.5/LICENSE
diff --git a/.../cxf/cxf-rt-frontend-simple-3.6.4/LICENSE → .../cxf/cxf-rt-frontend-simple-3.6.5/LICENSE b/.../cxf/cxf-rt-frontend-simple-3.6.4/LICENSE → .../cxf/cxf-rt-frontend-simple-3.6.5/LICENSE
diff --git a/...censes/cxf/cxf-rt-rs-client-3.6.4/LICENSE → ...censes/cxf/cxf-rt-rs-client-3.6.5/LICENSE b/...censes/cxf/cxf-rt-rs-client-3.6.4/LICENSE → ...censes/cxf/cxf-rt-rs-client-3.6.5/LICENSE
diff --git a/...es/cxf/cxf-rt-rs-json-basic-3.6.4/LICENSE → ...es/cxf/cxf-rt-rs-json-basic-3.6.5/LICENSE b/...es/cxf/cxf-rt-rs-json-basic-3.6.4/LICENSE → ...es/cxf/cxf-rt-rs-json-basic-3.6.5/LICENSE
diff --git a/...rt-rs-security-jose-3.6.4-gov4j-1/LICENSE → ...rt-rs-security-jose-3.6.5-gov4j-1/LICENSE b/...rt-rs-security-jose-3.6.4-gov4j-1/LICENSE → ...rt-rs-security-jose-3.6.5-gov4j-1/LICENSE
diff --git a/...f-rt-rs-security-jose-jaxrs-3.6.4/LICENSE → ...f-rt-rs-security-jose-jaxrs-3.6.5/LICENSE b/...f-rt-rs-security-jose-jaxrs-3.6.4/LICENSE → ...f-rt-rs-security-jose-jaxrs-3.6.5/LICENSE
diff --git a/...-description-common-openapi-3.6.4/LICENSE → ...-description-common-openapi-3.6.5/LICENSE b/...-description-common-openapi-3.6.4/LICENSE → ...-description-common-openapi-3.6.5/LICENSE
diff --git a/...vice-description-openapi-v3-3.6.4/LICENSE → ...vice-description-openapi-v3-3.6.5/LICENSE b/...vice-description-openapi-v3-3.6.4/LICENSE → ...vice-description-openapi-v3-3.6.5/LICENSE
diff --git a/...vice-description-swagger-ui-3.6.4/LICENSE → ...vice-description-swagger-ui-3.6.5/LICENSE b/...vice-description-swagger-ui-3.6.4/LICENSE → ...vice-description-swagger-ui-3.6.5/LICENSE
diff --git a/...icenses/cxf/cxf-rt-security-3.6.4/LICENSE → ...icenses/cxf/cxf-rt-security-3.6.5/LICENSE b/...icenses/cxf/cxf-rt-security-3.6.4/LICENSE → ...icenses/cxf/cxf-rt-security-3.6.5/LICENSE
diff --git a/...es/cxf/cxf-rt-security-saml-3.6.4/LICENSE → ...es/cxf/cxf-rt-security-saml-3.6.5/LICENSE b/...es/cxf/cxf-rt-security-saml-3.6.4/LICENSE → ...es/cxf/cxf-rt-security-saml-3.6.5/LICENSE
diff --git a/.../cxf/cxf-rt-transports-http-3.6.4/LICENSE → .../cxf/cxf-rt-transports-http-3.6.5/LICENSE b/.../cxf/cxf-rt-transports-http-3.6.4/LICENSE → .../cxf/cxf-rt-transports-http-3.6.5/LICENSE
diff --git a/...xf-rt-transports-http-jetty-3.6.4/LICENSE → ...xf-rt-transports-http-jetty-3.6.5/LICENSE b/...xf-rt-transports-http-jetty-3.6.4/LICENSE → ...xf-rt-transports-http-jetty-3.6.5/LICENSE
diff --git a/...censes/cxf/cxf-rt-ws-policy-3.6.4/LICENSE → ...censes/cxf/cxf-rt-ws-policy-3.6.5/LICENSE b/...censes/cxf/cxf-rt-ws-policy-3.6.4/LICENSE → ...censes/cxf/cxf-rt-ws-policy-3.6.5/LICENSE
diff --git a/...nses/cxf/cxf-rt-ws-security-3.6.4/LICENSE → ...nses/cxf/cxf-rt-ws-security-3.6.5/LICENSE b/...nses/cxf/cxf-rt-ws-security-3.6.4/LICENSE → ...nses/cxf/cxf-rt-ws-security-3.6.5/LICENSE
diff --git a/...ty-licenses/cxf/cxf-rt-wsdl-3.6.4/LICENSE → ...ty-licenses/cxf/cxf-rt-wsdl-3.6.5/LICENSE b/...ty-licenses/cxf/cxf-rt-wsdl-3.6.4/LICENSE → ...ty-licenses/cxf/cxf-rt-wsdl-3.6.5/LICENSE
diff --git a/...censes/cxf/cxf-tools-common-3.6.4/LICENSE → ...censes/cxf/cxf-tools-common-3.6.5/LICENSE b/...censes/cxf/cxf-tools-common-3.6.4/LICENSE → ...censes/cxf/cxf-tools-common-3.6.5/LICENSE
diff --git a/...ses/cxf/cxf-tools-validator-3.6.4/LICENSE → ...ses/cxf/cxf-tools-validator-3.6.5/LICENSE b/...ses/cxf/cxf-tools-validator-3.6.4/LICENSE → ...ses/cxf/cxf-tools-validator-3.6.5/LICENSE
diff --git a/...s/cxf/cxf-tools-wsdlto-core-3.6.4/LICENSE → ...s/cxf/cxf-tools-wsdlto-core-3.6.5/LICENSE b/...s/cxf/cxf-tools-wsdlto-core-3.6.4/LICENSE → ...s/cxf/cxf-tools-wsdlto-core-3.6.5/LICENSE
diff --git a/...ols-wsdlto-databinding-jaxb-3.6.4/LICENSE → ...ols-wsdlto-databinding-jaxb-3.6.5/LICENSE b/...ols-wsdlto-databinding-jaxb-3.6.4/LICENSE → ...ols-wsdlto-databinding-jaxb-3.6.5/LICENSE
diff --git a/...tools-wsdlto-frontend-jaxws-3.6.4/LICENSE → ...tools-wsdlto-frontend-jaxws-3.6.5/LICENSE b/...tools-wsdlto-frontend-jaxws-3.6.4/LICENSE → ...tools-wsdlto-frontend-jaxws-3.6.5/LICENSE
diff --git a/tools/command_line_interfaces/govway_vault/testsuite/build.xml b/tools/command_line_interfaces/govway_vault/testsuite/build.xml
@@ -59,7 +59,7 @@
 			<include name="cxf-core-*.jar"/>
 			<include name="cxf-rt-rs-json-basic-*.jar"/>
 			<include name="cxf-rt-rs-security-jose-*.jar"/>
-			<include name="asm-9.7.jar"/>
+			<include name="asm-9.7.1.jar"/>
 			<include name="woodstox-core-6.6.2.jar"/>
 			<include name="xmlschema-core-2.3.1.jar"/>
 		</fileset>

diff --git a/tools/rs/config/server/testsuite/build.xml b/tools/rs/config/server/testsuite/build.xml
@@ -38,7 +38,7 @@
                         <include name="snakeyaml-1.33-gov4j-1.jar"/>
                 </fileset>
                 <fileset dir="${required_lib}/cxf" >
-                        <include name="asm-9.7.jar"/>
+                        <include name="asm-9.7.1.jar"/>
                 </fileset>
         </path> 
 

diff --git a/tools/rs/monitor/server/testsuite/build.xml b/tools/rs/monitor/server/testsuite/build.xml
@@ -45,7 +45,7 @@
                         <include name="snakeyaml-1.33-gov4j-1.jar"/>
                 </fileset>
                 <fileset dir="${required_lib}/cxf" >
-                        <include name="asm-9.7.jar"/>
+                        <include name="asm-9.7.1.jar"/>
                 </fileset>
 	</path> 
 

diff --git a/tools/web_interfaces/loader/ant/openspcoop2-govwayLoader-war.xml b/tools/web_interfaces/loader/ant/openspcoop2-govwayLoader-war.xml
@@ -117,10 +117,10 @@
 				<include name="${jaxp_ri_jar}" />
 			</lib>
 			<lib dir="${required_lib_loaderConsole}/cxf">
-				<include name="cxf-rt-rs-security-jose-3.6.4-gov4j-1.jar" />
-				<include name="cxf-rt-rs-json-basic-3.6.4.jar" />
-				<include name="cxf-rt-security-3.6.4.jar" />
-				<include name="cxf-core-3.6.4-gov4j-1.jar" />
+				<include name="cxf-rt-rs-security-jose-3.6.5-gov4j-1.jar" />
+				<include name="cxf-rt-rs-json-basic-3.6.5.jar" />
+				<include name="cxf-rt-security-3.6.5.jar" />
+				<include name="cxf-core-3.6.5-gov4j-1.jar" />
 			</lib>
 			<lib dir="${required_lib_loaderConsole}/jackson" >
 				<include name="*.jar" />