ActiveMQ and commons-collection "security vulnerabilty"

[wabrit <al...@gmail.com>]

There has been a fair amount of coverage about a security vulnerability in
certain versions of the Java commons collections library.

The current version (5.13.0) of ActiveMQ installs with version 3.2.2 of
commons-collections in the lib\optional folder.

Are there any plans to uprev this version to a "safe" version of the library
in the next version of ActiveMQ, or has it been determined that it is OK to
perform this uprev manually as a post-install step, or has someone already
determined that ActiveMQ does not make use of the library in such a way as
to expose the vulnerability.

Many thanks 



--
View this message in context: http://activemq.2283324.n4.nabble.com/ActiveMQ-and-commons-collection-security-vulnerabilty-tp4704819.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: ActiveMQ and commons-collection "security vulnerabilty"

[wabrit <al...@gmail.com>]

Many thanks, and apologies for the duplicate post; I thought I'd searched for
posts about this before opening this one, but I obviously couldn't have
searched hard enough! 



--
View this message in context: http://activemq.2283324.n4.nabble.com/ActiveMQ-and-commons-collection-security-vulnerabilty-tp4704819p4704846.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: ActiveMQ and commons-collection "security vulnerabilty"

[Tim Bain <tb...@alumni.duke.edu>]

And the takeaway from that thread is that ActiveMQ 5.13.0 is already
secure, even with the vulnerable version of commons-collections, unless you
explicitly configure it to allow deserialization of the problematic classes.

Versions prior to 5.13.0, however, are vulnerable.

Tim
On Dec 9, 2015 10:39 AM, "jahlborn" <ja...@gmail.com> wrote:

> Duplicate of this thread:
>
> http://activemq.2283324.n4.nabble.com/Java-December-vulnerability-tp4704610.html
>
>
>
>
> --
> View this message in context:
> http://activemq.2283324.n4.nabble.com/ActiveMQ-and-commons-collection-security-vulnerabilty-tp4704819p4704820.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>

Re: ActiveMQ and commons-collection "security vulnerabilty"

[jahlborn <ja...@gmail.com>]

Duplicate of this thread:
http://activemq.2283324.n4.nabble.com/Java-December-vulnerability-tp4704610.html




--
View this message in context: http://activemq.2283324.n4.nabble.com/ActiveMQ-and-commons-collection-security-vulnerabilty-tp4704819p4704820.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.