[jira] [Created] (AMQ-6143) Security Vulnerabilities in 5.13.0
Kevin Goerlitz created AMQ-6143: --- Summary: Security Vulnerabilities in 5.13.0 Key: AMQ-6143 URL: https://issues.apache.org/jira/browse/AMQ-6143 Project: ActiveMQ Issue Type: Bug Components: Distribution Affects Versions: 5.13.0 Reporter: Kevin Goerlitz A security vulnerabilities scan of ActiveMQ 5.13.0 distribution reports issues with org.springframework spring-core 4.1.8 and org.apache.taglibs taglibs-standard-impl 1.2.1. Please upgrade org.springframework to at least version 4.1.9 (preferably version 4.2.4) and org.apache.taglibs to version 1.2.3 or 1.2.5. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (AMQ-7457) Support wider password encryption schemes
[ https://issues.apache.org/jira/browse/AMQ-7457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17152767#comment-17152767 ] Kevin Goerlitz commented on AMQ-7457: - Would it be possible to get this merged into the next 5.15.x maintenance release? > Support wider password encryption schemes > - > > Key: AMQ-7457 > URL: https://issues.apache.org/jira/browse/AMQ-7457 > Project: ActiveMQ > Issue Type: Improvement > Components: Security/JAAS >Reporter: Colm O hEigeartaigh >Assignee: Colm O hEigeartaigh >Priority: Major > Fix For: 5.16.0 > > Time Spent: 20m > Remaining Estimate: 0h > > For password encryption we only support the (default) algorithm > PBEWithMD5AndDES. This task is to support more modern PBE algorithms for: > * The activemq encrypt/decrypt script > * JAAS properties > In addition, we could use the more modern jasypt-spring4 dependency instead > of jasypt-spring13 -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Created] (AMQ-7515) Networked broker does not pass along queue consumer upon reconnect
Kevin Goerlitz created AMQ-7515: --- Summary: Networked broker does not pass along queue consumer upon reconnect Key: AMQ-7515 URL: https://issues.apache.org/jira/browse/AMQ-7515 Project: ActiveMQ Issue Type: Bug Components: Broker Affects Versions: 5.15.13, 5.15.10 Environment: ContOS 7 based docker image with Java 8. Reporter: Kevin Goerlitz We have a hub-spoke broker network with about 40 spokes. when restarting the hub broker, the spoke brokers reconnect. However, when some of the spoke brokers reconnect, they do not pass along the consumer of one of the queues to the hub. Messages the the queue are queued up and are not delivered until either the client app is restarted or the spoke broker is restarted (which will cause the client app to reconnect). It is usually the same set of spoke brokers that do not pass on the consumer. Each spoke broker has 5-8 consumers and it is always the consumer for the same app that is not passed on (the queue is different for each remote system). The spoke broker still has the consumer active. The brokers are stand-alone and the client apps are using the STOMP protocol. The spoke brokers are connected to the hub via a duplex connection initiated by the spoke. -- This message was sent by Atlassian Jira (v8.3.4#803005)
[jira] [Commented] (AMQ-8032) RuntimeConfigurationPlugin doesn't work with JDK11+
[ https://issues.apache.org/jira/browse/AMQ-8032?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17202198#comment-17202198 ] Kevin Goerlitz commented on AMQ-8032: - Ran into the same issue. Does the workaround work? > RuntimeConfigurationPlugin doesn't work with JDK11+ > --- > > Key: AMQ-8032 > URL: https://issues.apache.org/jira/browse/AMQ-8032 > Project: ActiveMQ > Issue Type: Bug > Components: Broker, Plugin >Affects Versions: 5.16.0 >Reporter: Jean-Baptiste Onofré >Assignee: Jean-Baptiste Onofré >Priority: Major > Fix For: 5.16.1 > > > If the broker configuration contains runtimeConfigurationPlugin like this: > {code:java} > > ... > > > > ... > {code} > the broker doesn't start due to: > {code:java} > Caused by: java.lang.NoClassDefFoundError: javax/xml/bind/JAXBException > at > org.apache.activemq.plugin.RuntimeConfigurationPlugin.installPlugin(RuntimeConfigurationPlugin.java:38) > at > org.apache.activemq.broker.BrokerService.addInterceptors(BrokerService.java:2505) > at > org.apache.activemq.broker.BrokerService.createBroker(BrokerService.java:2365) > at > org.apache.activemq.broker.BrokerService.getBroker(BrokerService.java:1053) > at > org.apache.activemq.broker.BrokerService.getAdminConnectionContext(BrokerService.java:2636) > at > org.apache.activemq.broker.BrokerService.startVirtualConsumerDestinations(BrokerService.java:2797) > at > org.apache.activemq.broker.BrokerService.startDestinations(BrokerService.java:2627) > at > org.apache.activemq.broker.BrokerService.doStartBroker(BrokerService.java:747) > at > org.apache.activemq.broker.BrokerService.startBroker(BrokerService.java:741) > at > org.apache.activemq.broker.BrokerService.start(BrokerService.java:644) > at > org.apache.activemq.xbean.XBeanBrokerService.afterPropertiesSet(XBeanBrokerService.java:73) > at > java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at > java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > at > java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > at java.base/java.lang.reflect.Method.invoke(Method.java:566) > at > org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeCustomInitMethod(AbstractAutowireCapableBeanFactory.java:1748) > at > org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1685) > at > org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1615) > ... 27 more > Caused by: java.lang.ClassNotFoundException: javax.xml.bind.JAXBException > at > java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:471) > at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:588) > at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521) > ... 45 more {code} > The problem is in the JAXB version in use. A simple workaround is to add JAXB > (API and Core) in activemq/lib (I'm testing the fix). > So, it could be just a question of documentation to add JAXB jar in ActiveMQ > in order to use runtimeConfigurationPlugin. -- This message was sent by Atlassian Jira (v8.3.4#803005)