This release includes 4 security fixes for security teams reviewing exposed deployments.
Published 1mo
Streaming & Message Queues
✓ No known CVEs patched
This release patches 4 known CVEs
Topics
activemq
amqp
amqps
apache
broker
java
+5 more
jms
messaging
mqtt
openwire
stomp
Affected surfaces
auth
rbac
Summary
AI summarySecurity hardening updates including advisory topic defaults, HTTPS restriction for BrokerView, LDAP URI validation, and Stomp header max‑frame‑size enforcement.
Full changelog
What's Changed
- Bump to 5.19.7-SNAPSHOT by @jbonofre in https://github.com/apache/activemq/pull/2059
- [5.19.x] Update SECURITY.md and default configs for advisory topics by @cshannon in https://github.com/apache/activemq/pull/2058
- [5.19.x] Update Stomp transports with improved validation (#2064) by @cshannon in https://github.com/apache/activemq/pull/2066
- [5.19.x] Send advisory messages using Broker connection context (#2071) by @cshannon in https://github.com/apache/activemq/pull/2076
- [5.19.x] Add https to BrokerView restricted list (#2073) by @cshannon in https://github.com/apache/activemq/pull/2079
- [5.19.x] Add validation for WireFormatInfo (#2080) by @cshannon in https://github.com/apache/activemq/pull/2082
- [5.19.x] Ensure at most one BrokerInfo command is received (#2083) by @cshannon in https://github.com/apache/activemq/pull/2087
- [5.19.x] Restrict full web console URI to admins role (#2074) by @cshannon in https://github.com/apache/activemq/pull/2091
- [5.19.x] Adding missing jsp escapes (#2089) by @cshannon in https://github.com/apache/activemq/pull/2093
- [5.19.x] Limit WireFormatInfo platform details to a reasonable length (#2088) by @cshannon in https://github.com/apache/activemq/pull/2095
- [AMQ-9288] Fix TransportConnection logger to include exception message on Async Error (5.19.x backport) by @trex-amazon in https://github.com/apache/activemq/pull/2062
- [5.19.x] Add validation for LDAP network connector URIs (#2077) by @cshannon in https://github.com/apache/activemq/pull/2099
- [5.19.x] Add back missing closing tag (#2100) by @cshannon in https://github.com/apache/activemq/pull/2106
- [5.19.x] Validate Stomp headers against max frame size (#2104) by @cshannon in https://github.com/apache/activemq/pull/2108
- [5.19.x] Remove extra buffer copy in StompNIOSSLTransport (#2107) by @cshannon in https://github.com/apache/activemq/pull/2109
- [5.19.x] Replace active temp dests map with set (#2113) by @cshannon in https://github.com/apache/activemq/pull/2115
- [5.19.x] Refactor network connections to process after ConnectionInfo (#2112) by @cshannon in https://github.com/apache/activemq/pull/2117
- [5.19.x] Provide a flexible filter style input stream that limits read amounts (#2118) by @cshannon in https://github.com/apache/activemq/pull/2121
- [5.19.x] Add flag to optionally enable temp destination stealing (#2122) by @cshannon in https://github.com/apache/activemq/pull/2126
- [5.19.x] Improve the broker's handling of message corruption (#2136) by @cshannon in https://github.com/apache/activemq/pull/2145
- [5.19.x] Add support for maxInflateDataSize to limit uncompressed buffers (#2139) by @cshannon in https://github.com/apache/activemq/pull/2148
- [5.19.x] Fix test by enabling allowTempDestinationStealing (#2146) by @cshannon in https://github.com/apache/activemq/pull/2151
- [5.19.x] [#2020] Add expiryCheckEnabled option to MessageEvictionStrategy to s… by @mattrpav in https://github.com/apache/activemq/pull/2149
- [5.19.x] Fix maxUncommittedCount usage across a network of brokers by @mattrpav in https://github.com/apache/activemq/pull/2152
- [5.19.x] Improve handling of partial reads and EOF in Frame size limited filter (#2154) by @cshannon in https://github.com/apache/activemq/pull/2156
- [5.19.x] Preserve ${...} placeholders when removing/modifying networkConnectors in RuntimeConfigurationPlugin (#2123) by @jbonofre in https://github.com/apache/activemq/pull/2135
New Contributors
- @trex-amazon made their first contribution in https://github.com/apache/activemq/pull/2062
Full Changelog: https://github.com/apache/activemq/compare/activemq-5.19.7...activemq-5.19.8
Security Fixes
- Update SECURITY.md and default configs for advisory topics
- Restrict full web console URI to admins role (#2074)
- Adding missing jsp escapes (#2089)
- Add validation for LDAP network connector URIs (#2077)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]