Fix CVEs (CVE-2026-42253, etc) (5.18.x)#214
Open
epearson-tt wants to merge 6 commits into
Open
Conversation
…sportFactory (apache#2003) (apache#2011) By default the VMTransportFactory will not be allowed to use XBeanBrokerFactory to create new brokers. Only the default and properties factories will be enabled. To enable the XBeanBrokerFactory, the property org.apache.activemq.transport.VM_TRANSPORT_FACTORY_SCHEMES_ENABLED can be configured. (cherry picked from commit 103962e) (cherry picked from commit c28f59b)
…pache#2004) (apache#2013) Parentheses are optional when creating composite and nested URIs so this updates the validation to handle missing parens as well. Follow on to apache#1847 (cherry picked from commit cf00060) (cherry picked from commit c034ea8)
…pache#2015) * Disable the message servlet by default * Add warning message and deprecated annotation (cherry picked from commit d8a8540) (cherry picked from commit d82f61f)
…oveDestination (apache#2008) * [apache#2005] Fix authorization check on removeDestination (cherry picked from commit 79da3ee) (cherry picked from commit 6095413) * [apache#2005] 6.2.x/5.19.x - Remove ParallelTest for backport (cherry picked from commit 333a7d3) * [apache#2005] 5.19.x - Refactory jakarta.jms to javax.jms for backport (cherry picked from commit 98d531c)
…ault (apache#2025) (apache#2038) * Harden web console and Jolokia access by default jetty.xml: - Add Referrer-Policy and Permissions-Policy response headers; provide commented-out Strict-Transport-Security for HTTPS deployments. - Wrap the existing HandlerCollection in an InetAccessHandler and restrict access to loopback (127.0.0.1, ::1) by default. Provide commented-out templates for RFC1918 includes and exclude rules. - Tie Server.start() to the loopback include beans via depends-on so the allow-list is fully populated before the server starts. - Add a commented-out ForwardedRequestCustomizer for reverse-proxy setups, with a warning about header spoofing when the proxy does not strip inbound X-Forwarded-* headers. jolokia-access.xml: - Restrict Jolokia to HTTP POST to kill GET-based CSRF/SSRF vectors. - Deny destructive and privileged broker operations (terminateJVM, stop, restart, add/removeConnector, add/removeQueue/Topic, durable subscriber lifecycle, runtime limit setters, reloadLog4jProperties). - Deny destination message-data mutation (purge, remove/copy/move messages, sendTextMessage*, pause/resume); browse* remains allowed. - Deny durable subscriber destroy/setSelector and JobScheduler removeJob*. - Deny NetworkConnector Password/RemotePassword attributes and credential setters. - Deny known JMX RCE / introspection surfaces: javax.management.loading MLet, JMImplementation, java.util.logging, java.lang:type=Memory and ClassLoading, plus java.lang:type=Runtime SystemProperties and InputArguments. * jetty.xml: restrict Jolokia endpoint to admins role Add a jolokiaSecurityConstraintMapping that binds adminSecurityConstraint (admins-only) to /api/jolokia/*, mirroring how *.action is gated on the web console. Wired into securityHandler before securityConstraintMapping so the admin role check applies to all Jolokia requests rather than the broader users/admins constraint. (cherry picked from commit 66efdf1)
…nc (apache#2049) This update waits until the ConnectionInfo command is processed by the entire broker chain without error before sending the BrokerSubscriptionInfo command for durable sync back to a remote broker requesting it (cherry picked from commit 038cb1e)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVEs addressed: