This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 1mo
Streaming & Message Queues
✓ No known CVEs patched
This release patches 2 known CVEs
Topics
activemq
amqp
amqps
apache
broker
java
+5 more
jms
messaging
mqtt
openwire
stomp
Affected surfaces
auth
rbac
Summary
AI summarySecurity hardening: advisory topics updated, BrokerView restricted to HTTPS for admins.
Full changelog
What's Changed
- Bump to 6.2.7-SNAPSHOT by @jbonofre in https://github.com/apache/activemq/pull/2060
- [6.2.x] Update SECURITY.md and default configs for advisory topics by @cshannon in https://github.com/apache/activemq/pull/2057
- [6.2.x] Update Stomp transports with improved validation (#2064) by @cshannon in https://github.com/apache/activemq/pull/2065
- [6.2.x] Send advisory messages using Broker connection context (#2071) by @cshannon in https://github.com/apache/activemq/pull/2075
- [6.2.x] Add https to BrokerView restricted list (#2073) by @cshannon in https://github.com/apache/activemq/pull/2078
- [6.2.x] Add validation for WireFormatInfo (#2080) by @cshannon in https://github.com/apache/activemq/pull/2081
- [6.2.x] Ensure at most one BrokerInfo command is received (#2083) by @cshannon in https://github.com/apache/activemq/pull/2086
- [6.2.x] Restrict full web console URI to admins role (#2074) by @cshannon in https://github.com/apache/activemq/pull/2090
- [6.2.x] Adding missing jsp escapes (#2089) by @cshannon in https://github.com/apache/activemq/pull/2092
- [6.2.x] Limit WireFormatInfo platform details to a reasonable length (#2088) by @cshannon in https://github.com/apache/activemq/pull/2094
- [6.2.x] Add validation for LDAP network connector URIs (#2077) by @cshannon in https://github.com/apache/activemq/pull/2098
- [6.2.x] Add back missing closing tag (#2100) by @cshannon in https://github.com/apache/activemq/pull/2105
- [6.2.x] Validate Stomp headers against max frame size (#2104) by @cshannon in https://github.com/apache/activemq/pull/2110
- [6.2.x] Remove extra buffer copy in StompNIOSSLTransport (#2107) by @cshannon in https://github.com/apache/activemq/pull/2111
- [6.2.x] Replace active temp dests map with set (#2113) by @cshannon in https://github.com/apache/activemq/pull/2114
- [6.2.x] Refactor network connections to process after ConnectionInfo (#2112) by @cshannon in https://github.com/apache/activemq/pull/2116
- [6.2.x] Provide a flexible filter style input stream that limits read amounts (#2118) by @cshannon in https://github.com/apache/activemq/pull/2120
- [6.2.x] Add flag to optionally enable temp destination stealing (#2122) by @cshannon in https://github.com/apache/activemq/pull/2125
- [6.2.x] Improve the broker's handling of message corruption (#2136) by @cshannon in https://github.com/apache/activemq/pull/2143
- [6.2.x] Add support for maxInflateDataSize to limit uncompressed buffers (#2139) by @cshannon in https://github.com/apache/activemq/pull/2147
- [6.2.x] Fix test by enabling allowTempDestinationStealing (#2146) by @cshannon in https://github.com/apache/activemq/pull/2150
- [6.2.x] [#2137] Fix maxUncommittedCount usage across a network of brokers by @mattrpav in https://github.com/apache/activemq/pull/2153
- Fix #2153 - remove test annotation from 6.2.x by @cshannon in https://github.com/apache/activemq/pull/2157
- [6.2.x] Improve handling of partial reads and EOF in Frame size limited filter (#2154) by @cshannon in https://github.com/apache/activemq/pull/2155
- [6.2.x] Preserve ${...} placeholders when removing/modifying networkConnectors in RuntimeConfigurationPlugin (#2123) by @jbonofre in https://github.com/apache/activemq/pull/2134
Full Changelog: https://github.com/apache/activemq/compare/activemq-6.2.6...activemq-6.2.7
Security Fixes
- Advisory topics configuration updated in SECURITY.md and defaults
- BrokerView access now limited to HTTPS connections for admin role
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]