Skip to content

ActiveMQ

vactivemq-6.2.7 scope: activemq Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

activemq amqp amqps apache broker java
+5 more
jms messaging mqtt openwire stomp

Affected surfaces

auth rbac

Summary

AI summary

Security hardening: advisory topics updated, BrokerView restricted to HTTPS for admins.

Full changelog

What's Changed

  • Bump to 6.2.7-SNAPSHOT by @jbonofre in https://github.com/apache/activemq/pull/2060
  • [6.2.x] Update SECURITY.md and default configs for advisory topics by @cshannon in https://github.com/apache/activemq/pull/2057
  • [6.2.x] Update Stomp transports with improved validation (#2064) by @cshannon in https://github.com/apache/activemq/pull/2065
  • [6.2.x] Send advisory messages using Broker connection context (#2071) by @cshannon in https://github.com/apache/activemq/pull/2075
  • [6.2.x] Add https to BrokerView restricted list (#2073) by @cshannon in https://github.com/apache/activemq/pull/2078
  • [6.2.x] Add validation for WireFormatInfo (#2080) by @cshannon in https://github.com/apache/activemq/pull/2081
  • [6.2.x] Ensure at most one BrokerInfo command is received (#2083) by @cshannon in https://github.com/apache/activemq/pull/2086
  • [6.2.x] Restrict full web console URI to admins role (#2074) by @cshannon in https://github.com/apache/activemq/pull/2090
  • [6.2.x] Adding missing jsp escapes (#2089) by @cshannon in https://github.com/apache/activemq/pull/2092
  • [6.2.x] Limit WireFormatInfo platform details to a reasonable length (#2088) by @cshannon in https://github.com/apache/activemq/pull/2094
  • [6.2.x] Add validation for LDAP network connector URIs (#2077) by @cshannon in https://github.com/apache/activemq/pull/2098
  • [6.2.x] Add back missing closing tag (#2100) by @cshannon in https://github.com/apache/activemq/pull/2105
  • [6.2.x] Validate Stomp headers against max frame size (#2104) by @cshannon in https://github.com/apache/activemq/pull/2110
  • [6.2.x] Remove extra buffer copy in StompNIOSSLTransport (#2107) by @cshannon in https://github.com/apache/activemq/pull/2111
  • [6.2.x] Replace active temp dests map with set (#2113) by @cshannon in https://github.com/apache/activemq/pull/2114
  • [6.2.x] Refactor network connections to process after ConnectionInfo (#2112) by @cshannon in https://github.com/apache/activemq/pull/2116
  • [6.2.x] Provide a flexible filter style input stream that limits read amounts (#2118) by @cshannon in https://github.com/apache/activemq/pull/2120
  • [6.2.x] Add flag to optionally enable temp destination stealing (#2122) by @cshannon in https://github.com/apache/activemq/pull/2125
  • [6.2.x] Improve the broker's handling of message corruption (#2136) by @cshannon in https://github.com/apache/activemq/pull/2143
  • [6.2.x] Add support for maxInflateDataSize to limit uncompressed buffers (#2139) by @cshannon in https://github.com/apache/activemq/pull/2147
  • [6.2.x] Fix test by enabling allowTempDestinationStealing (#2146) by @cshannon in https://github.com/apache/activemq/pull/2150
  • [6.2.x] [#2137] Fix maxUncommittedCount usage across a network of brokers by @mattrpav in https://github.com/apache/activemq/pull/2153
  • Fix #2153 - remove test annotation from 6.2.x by @cshannon in https://github.com/apache/activemq/pull/2157
  • [6.2.x] Improve handling of partial reads and EOF in Frame size limited filter (#2154) by @cshannon in https://github.com/apache/activemq/pull/2155
  • [6.2.x] Preserve ${...} placeholders when removing/modifying networkConnectors in RuntimeConfigurationPlugin (#2123) by @jbonofre in https://github.com/apache/activemq/pull/2134

Full Changelog: https://github.com/apache/activemq/compare/activemq-6.2.6...activemq-6.2.7

Security Fixes

  • Advisory topics configuration updated in SECURITY.md and defaults
  • BrokerView access now limited to HTTPS connections for admin role

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ActiveMQ

Get notified when new releases ship.

Sign up free

About ActiveMQ

Apache ActiveMQ

All releases →

Related context

Beta — feedback welcome: [email protected]