You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@artemis.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2026/09/10 17:10:01 UTC
[jira] [Commented] (ARTEMIS-6246) Pre-Authentication Cluster Credential Exposure to Discovered Peers
[ https://issues.apache.org/jira/browse/ARTEMIS-6246?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113960#comment-18113960 ]
ASF subversion and git services commented on ARTEMIS-6246:
----------------------------------------------------------
Commit ffb79bb98704284ed8cc2ab0cec1f35637c4c858 in artemis's branch refs/heads/main from Clebert Suconic
[ https://gitbox.apache.org/repos/asf?p=artemis.git;h=ffb79bb987 ]
Fix compatibility with older clients during pre-authentication topology exchange.
Before authentication, the server sends a placeholder topology entry so clients don't
block waiting for topology data. Previously, this placeholder used null connectors with
a dummy name (PRE_AUTH_CONNECTOR), which older clients couldn't handle.
The fix now sends the actual connector for the node the client is already connected to.
Once the client authenticates, the placeholder is replaced with the real topology.
(cherry picked from commit 96eae4cee2de363af8dc381a5c28772437af050c)
ARTEMIS-6246
> Pre-Authentication Cluster Credential Exposure to Discovered Peers
> ------------------------------------------------------------------
>
> Key: ARTEMIS-6246
> URL: https://issues.apache.org/jira/browse/ARTEMIS-6246
> Project: Artemis
> Issue Type: Bug
> Reporter: Clebert Suconic
> Priority: Major
> Fix For: 2.58.0
>
>
> this is https://artemis.apache.org/security-advisories.data/CVE-2026-49364-announcement.txt
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@artemis.apache.org
For additional commands, e-mail: issues-help@artemis.apache.org