Minor Description
An old, and vulnerable version of ActiveMQ is used by Oozie's tests (5.13.3).
It seems that the jars are even included in the oozie-client with "compile" scope, but we only use them in unit tests.
Oozie-client uses the JMS-API only from these jars, which could be included separately (javax.jms).
The version could be upgraded to 5.14.2 and the scope changed to "test" instead of "compile".