Update to ActiveMQ 5.19.7 (5.19.x)#211
Open
epearson-tt wants to merge 15 commits into
Open
Conversation
…) (apache#1974) Follow on to apache#1949 (cherry picked from commit 1f2a257)
…ache#2003) (apache#2011) By default the VMTransportFactory will not be allowed to use XBeanBrokerFactory to create new brokers. Only the default and properties factories will be enabled. To enable the XBeanBrokerFactory, the property org.apache.activemq.transport.VM_TRANSPORT_FACTORY_SCHEMES_ENABLED can be configured. (cherry picked from commit 103962e)
…ache#2013) Parentheses are optional when creating composite and nested URIs so this updates the validation to handle missing parens as well. Follow on to apache#1847 (cherry picked from commit cf00060)
* Disable the message servlet by default * Add warning message and deprecated annotation (cherry picked from commit d8a8540)
…pache#2008) * [apache#2005] Fix authorization check on removeDestination (cherry picked from commit 79da3ee) (cherry picked from commit 6095413) * [apache#2005] 6.2.x/5.19.x - Remove ParallelTest for backport (cherry picked from commit 333a7d3) * [apache#2005] 5.19.x - Refactory jakarta.jms to javax.jms for backport
…pache#2026) (apache#2028) Many classes in the java.lang package should not ever need to be serialized so this commit removes the default package and instead includes an allow list of classes that are ok to serialize that are part of the package. Users have the option to restore the previous behavior by appending "java.lang" back to the serialized packages property if desired. (cherry picked from commit e9ed448)
- netty 4.1.94.Final -> 4.1.133.Final (CVE-2024-29025, CVE-2025-58057, SslHandler native crash patched in 4.1.118.Final) - snappy 1.1.2 -> 1.1.10.8 (CVE-2023-34453/34454/34455, CVE-2023-43642) - karaf 4.3.7 -> 4.3.10 (CVE-2022-40145 JNDI LDAP RCE)
…apache#2036) * Harden default broker and web console configuration Reduce the attack surface of the sample broker shipped in the binary assembly: * activemq.xml: enable only the openwire TCP transportConnector by default; amqp, stomp, mqtt and ws are commented out with a note pointing to the SSL-secured variants. * activemq.xml: add a commented <plugins> block wiring JAAS authentication, destination-level authorization and broker-side audit logging, with a prominent reminder to rotate the default admin=admin credentials and an ACTIVEMQ_OPTS hint for restricting ObjectMessage deserialization. * jetty.xml: suppress X-Powered-By and Date response headers in addition to the already-disabled Server header. * jetty.xml: add Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy response headers alongside the existing CSP/XFO/XSS rules. * Add SSL recommendation comment on default openwire connector
… (apache#2038) * Harden web console and Jolokia access by default jetty.xml: - Add Referrer-Policy and Permissions-Policy response headers; provide commented-out Strict-Transport-Security for HTTPS deployments. - Wrap the existing HandlerCollection in an InetAccessHandler and restrict access to loopback (127.0.0.1, ::1) by default. Provide commented-out templates for RFC1918 includes and exclude rules. - Tie Server.start() to the loopback include beans via depends-on so the allow-list is fully populated before the server starts. - Add a commented-out ForwardedRequestCustomizer for reverse-proxy setups, with a warning about header spoofing when the proxy does not strip inbound X-Forwarded-* headers. jolokia-access.xml: - Restrict Jolokia to HTTP POST to kill GET-based CSRF/SSRF vectors. - Deny destructive and privileged broker operations (terminateJVM, stop, restart, add/removeConnector, add/removeQueue/Topic, durable subscriber lifecycle, runtime limit setters, reloadLog4jProperties). - Deny destination message-data mutation (purge, remove/copy/move messages, sendTextMessage*, pause/resume); browse* remains allowed. - Deny durable subscriber destroy/setSelector and JobScheduler removeJob*. - Deny NetworkConnector Password/RemotePassword attributes and credential setters. - Deny known JMX RCE / introspection surfaces: javax.management.loading MLet, JMImplementation, java.util.logging, java.lang:type=Memory and ClassLoading, plus java.lang:type=Runtime SystemProperties and InputArguments. * jetty.xml: restrict Jolokia endpoint to admins role Add a jolokiaSecurityConstraintMapping that binds adminSecurityConstraint (admins-only) to /api/jolokia/*, mirroring how *.action is gated on the web console. Wired into securityHandler before securityConstraintMapping so the admin role check applies to all Jolokia requests rather than the broader users/admins constraint.
This update waits until the ConnectionInfo command is processed by the entire broker chain without error before sending the BrokerSubscriptionInfo command for durable sync back to a remote broker requesting it
[maven-release-plugin] copy for tag activemq-5.19.7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.