Critical vulnerabilities in dependency (Apache CXF)

[StyopinN]

There are a lot of known vulnerabilities in Apache CXF.

For example, very critical CVE-2022-46364 in cxf-core-3.3.9:

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

Reference: https://www.cve.org/CVERecord?id=CVE-2022-46364

Is it possible to update <cxf.version>3.3.9</cxf.version> to latest version (4.0.0 at this moment)? It look like binary incompatible and need some fixes in Winrm4j

[StyopinN]

I have started solution, but have a problem with generating code for client: jaxws/bindings.xml rules should change package name, but they don't

[astharora]

Is anyone working on this?

[bertysentry]

Hi! 👋

If you're looking for an actively maintained alternative to winrm4j, we maintain winrm-java, another WinRM (light) client for Java and its documentation with zero runtime dependencies, designed to be easy to migrate to from winrm4j:

	winrm4j 0.12.x	winrm-java 2.1
Dependencies	Apache CXF + HttpClient + JAXB (dozens of jars)	None (single ~300 kB jar)
Java	8 (needs manual JAX-WS/JAXB additions on 11+)	11+ (works out of the box on current JDKs)
Commands & PowerShell	executeCommand / executePs	command(...) / powerShell(...) — no script size limit, no escaping
WQL / WMI queries	—	✔ (paged, streamable)
File transfer	—	✔ (through the WinRM channel itself, no SMB)
Live output, stdin, Process-style streaming	partial (Writer tail)	✔
Maintenance	last commit 2023	active

Migration is pretty straightforward:

try (WinRMClient client = WinRMClient.builder("server01").credentials("DOMAIN\\user", password).build()) {
    CommandResult result = client.powerShell("Get-Service | Where-Object Status -eq 'Running'").execute();
    System.out.println(result.stdout());
}

There's a dedicated migration guide mapping every WinRmTool / WinRmClientBuilder option to its equivalent, including the behavioral differences to watch for

Maven coordinates: org.metricshub:winrm-java:2.1.00, and license is Apache-2.0, like winrm4j.