Resolve CVE-2026-49432, etc (6.0.x)#243
Open
epearson-tt wants to merge 13 commits into
Open
Conversation
This commit fixes conversion of messages that are sent or received using Stomp when the body contains characters that require 4 bytes for encoding using standard UTF-8. ActiveMQ and OpenWire currently use a modified UTF-8 encoding that only uses 3 bytes so the conversion previously was breaking because the body was encoded using standard JDK UTF-8 encoding and set directly on an ActiveMQText message which was leading to decoding errors later when the ActiveMQMessage tried to decode using the modified encoder. The reverse was also was true and was breaking in some cases. The fix now makes sure to correctly decode the Stomp message back to a String first and set that on the ActiveMQ message so it can be re-encoded correctly. The reverse is fixed as well so both conversion from Stomp -> OpenWire and OpenWire -> Stomp work. Tests have been added for Stomp -> OpenWire, OpenWire -> Stomp, and Stomp -> Stomp which is really Stomp -> OpenWire -> Stomp. (cherry picked from commit 3ddf515) (cherry picked from commit 2f44e8d)
…che#2064) (apache#2065) This update makes the following changes to improve validation for the Stomp transport: * Verifies that the first frame seen by the server is either a CONNECT (or FRAME) frame. * Verifies that a duplicate CONNECT (or FRAME) frame is not received. * Adds validation to make sure a content-length header that is set is not negative. * Adds a new server mode (default true) to the Stomp wireformat to handle the validation differences between clients and servers. Client mode is only used for testing (currently). Also adds the option to configure using the StompWireFormatFactory in case there is a future use case. * Centralizes the state tracking for frame size validation and for the new validation checks inside StompWireFormat so that it is shared by NIO, non-NIO and WS transports. * Adds tests to verify everything for the NIO transports, non-NIO transprots and WS transports. If any of these new validation checks throw a protocol error then it is marked as a fatal exception, an error is sent to the client and connection closed. Both NIO and non-NIO will stop parsing the rest of the frame on error, but only NIO transport errors will stop reading the frame from the socket buffer because non NIO requires reading the entire frame into a buffer first to validate. (cherry picked from commit 1493db9) (cherry picked from commit 713cae9)
…he#2081) The max number of properties in the map for the WireFormatInfo command was lowered to 64 and a new max value buffer size was added to validate buffers created during unmarshalling of the properties map. The max buffer allowed has been set to 512 bytes. This also adds a maxDepth check for handling nested collections inside the map. It is set to 0 which will block list/map from being used as a value for a property. (cherry picked from commit 6fc46e5) (cherry picked from commit e25f9b8)
…ache#2083) (apache#2086) There should only ever be at most one BrokerInfo command received on a connection so we should throw an exception and close the connection if a second is receveived as that is a protocol error. (cherry picked from commit 80562ea) (cherry picked from commit f3a365e)
…2074) (apache#2090) Change the admin security constraint mapping from *.action to /admin/* so the entire web console (including read-only pages) requires the admins role, not just action endpoints. Add comments to each constraint mapping explaining its scope, and remove duplicate Referrer-Policy and Permissions-Policy rewrite rules left over from earlier edits. Backport adaptation for the 6.0.x-TT.x branch: upstream apache#2074 also defines a jolokiaSecurityConstraintMapping bean (restricting /api/jolokia/* to admins), but 6.0.x's securityHandler wires only adminSecurityConstraintMapping and securityConstraintMapping. The Jolokia constraint wiring comes from the separate Jolokia-access hardening (CVE-2026-34197/40466 family), which is not present on this branch and is outside the scope of CVE-2026-49877. The unreferenced bean was therefore omitted to avoid dead configuration; the CVE-2026-49877 fix -- restricting the full /admin/* console to the admins role -- is applied in full. (cherry picked from commit 085efea) Co-authored-by: JB Onofré <jbonofre@apache.org> (cherry picked from commit be70a7e)
…e#2077) (apache#2098) Validate the URIs provided by LDAP searches do not contain any protocols from the denied list. (cherry picked from commit ac3d064) (cherry picked from commit f055bcc)
…#2104) (apache#2110) Updates Stomp codec to check headers against max frame size during reading of the headers and not after when reading the body. (cherry picked from commit 7cb413b) (cherry picked from commit b3b48b7)
…che#2107) (apache#2111) Optimizes the StompNIOSSLTransport by removing the unnecessary extra byte array allocation and buffer copy when processing frames (cherry picked from commit 403ac4f) (cherry picked from commit 9d48350)
…pache#2114) For some reason ActiveMQConnection was using a map instead of a set to store the destinations, and just stored the exact same thing as the key and value. Furthermore, when checking if the map contained the destination a call was being made to containsValue() which requires iterating over the entire map. This commit replaced the Map with a Set which simplifies things and makes the contains() check constant. Also, the scope of the set was changed from public to package because it makes no sense to have the scope as public and should be limited to only classes in the same package. (cherry picked from commit b20a4c7) (cherry picked from commit dddcc42)
…its read amounts (apache#2118) (apache#2120) This commit supplies a utility type that acts as a filter input stream style stream wrapper than can be configured with an available bytes window which decreases as bytes are read from the stream. This allows a transport or other utility to limit what can be read based on a fixed amount such as a max frame size option. (cherry picked from commit 81ab887) Co-authored-by: Timothy Bish <tabish121@gmail.com> (cherry picked from commit 562fa8d)
…ng (apache#2122) (apache#2125) This adds a flag to allow other connections to create subscriptions on a temp destination, the default has been set to off. Setting to true enables some use cases to work such as failover but most of the time it is not needed and should be disabled to be JMS client spec compatible. The java client also already checked this, this now adds a broker side check as well. (cherry picked from commit d8c5672) (cherry picked from commit 225dcb6)
…pache#2136) (apache#2143) This commit improves the brokers handling of messages that are corrupt and can't be read, such as unmarshaling the properties or body. Currently if there is an error an IOException is triggered and can lead to a client connection be closed. Furthermore for queues messages can be stuck and no new messages can be delivered. To improve things the following changes have been made: * The MarshallingSupport utility that is used to unmarshal message properties and bodies has improve validation to check for errors such is incorrectly encoded size values. * The broker will now handle message format errors both when messages are evaluated to add to subscriptions and during dispatch to consumers when the messages are already on a subscription. * The Stomp protocol converter was fixed to not auto ack or track acks until the message has been converted. * AMQP no longer swallows message format errors and will throw so the erors can be handled by the TransportConnection. All of these changes allow the broker to deal with corrupt messages and remove them (and possibly DLQ) vs causing the connections to close or the messages to block consumers forever in the queue case. Backport adaptation for the 6.0.x-TT.x branch: the unused java.util.stream.Collectors import that upstream apache#2136 adds to Topic was omitted as it is not referenced on this branch. (Upstream apache#2136 also drops the CompletableFuture and CopyOnWriteArrayList imports from TransportConnection because PR apache#2112 -- not backported here -- had removed their usages. On this branch both symbols remain in use -- CompletableFuture via the CVE-2026-49270 fix now present on the base, and CopyOnWriteArrayList via getConnections() -- and their imports are supplied by the base, so this commit makes no TransportConnection import change.) (cherry picked from commit b20e61c) (cherry picked from commit ecfd133)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses CVEs: