CVE-2025-66453 replace servicemix rhino bundle with org.mozilla:rhino:1.7.15.1

[Copilot]

org.apache.servicemix.bundles:org.apache.servicemix.bundles.rhino:1.7.15_1 inlines org.mozilla:rhino:1.7.15, which is vulnerable to CVE-2025-66453 (CVSS 7.5) — a DoS via Number.prototype.toFixed() that drives DToA.pow5mult into unbounded CPU consumption. No newer ServiceMix bundle exists on Maven Central; the fixed org.mozilla:rhino:1.7.15.1 is a safe drop-in since OpenAM deploys as a WAR (no OSGi runtime) and uses only the standard org.mozilla.javascript.* API.

Changes

• pom.xml — updated rhino.version to 1.7.15.1 and replaced the <dependencyManagement> entry:

  <!-- before -->
  <groupId>org.apache.servicemix.bundles</groupId>
  <artifactId>org.apache.servicemix.bundles.rhino</artifactId>
  
  <!-- after -->
  <groupId>org.mozilla</groupId>
  <artifactId>rhino</artifactId>

• openam-scripting/pom.xml — same groupId/artifactId substitution for the consuming module dependency.

No source changes required; org.mozilla:rhino exposes the identical org.mozilla.javascript.* API surface.

[maximthomas]

This upgrade leads to dependency duplication, see #980, so there will be duplicated transitive servicemix dependency from commons and the current org.mozilla.rhino dependency. Changing dependency in the commons project from servicemix to org.mozilla will break OpenIDM

CVE-2025-66453 has low severity (2.7/10)

[maximthomas]

Doing a research to replace the servicemix bundle in the OpenIDM project

[maximthomas]

Rhino dependency declaration can be removed from the file. It is already declared in the commons project.