You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@activemq.apache.org by "Bruce Snyder (Created) (JIRA)" <ji...@apache.org> on 2012/02/01 03:56:59 UTC
[jira] [Created] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Upgrade Jetty to address CVE-2011-4461
--------------------------------------
Key: AMQ-3693
URL: https://issues.apache.org/jira/browse/AMQ-3693
Project: ActiveMQ
Issue Type: Task
Reporter: Bruce Snyder
Attachments: upgrade-jetty.patch
Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461|CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
Fwd: [jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by Bruce Snyder <br...@gmail.com>.
Anyone mind if I commit this patch to upgrade Jetty so that we can
address the CVE?
Also, what about cutting a new release to get this out there?
Bruce
---------- Forwarded message ----------
From: Bruce Snyder (Updated) (JIRA) <ji...@apache.org>
Date: Wed, Feb 1, 2012 at 9:44 AM
Subject: [jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
To: dev@activemq.apache.org
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: (was: upgrade-jetty.patch)
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA
administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
--
perl -e 'print unpack("u30","D0G)U8V4\@4VYY9&5R\"F)R=6-E+G-N>61E<D\!G;6%I;\"YC;VT*"
);'
ActiveMQ in Action: http://bit.ly/2je6cQ
Blog: http://bruceblog.org/
Twitter: http://twitter.com/brucesnyder
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Assignee: (was: Bruce Snyder)
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461|CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Bruce Snyder (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13197539#comment-13197539 ]
Bruce Snyder commented on AMQ-3693:
-----------------------------------
I have attached a patch for this work, but please note that the patch was created against Jetty 7.6.0.RC4. The changes will need to use the full Jetty 7.6.0 release when that release is made available.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Timothy Bish (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Timothy Bish updated AMQ-3693:
------------------------------
Fix Version/s: 5.6.0
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Fix For: 5.6.0
>
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Timothy Bish (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13198041#comment-13198041 ]
Timothy Bish commented on AMQ-3693:
-----------------------------------
AMQ-3508 also requests a jetty upgrade. I attempt to go to 7.5.2 at the time and the webconsole failed to function afterwards with a NoSuchMethodException. Should make sure when updating that the console still works as well.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Affects Version/s: 5.5.1
Assignee: Bruce Snyder
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Assignee: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461|CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Timothy Bish (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13215941#comment-13215941 ]
Timothy Bish commented on AMQ-3693:
-----------------------------------
Bumped Jetty to v7.6.1 as the Web Console now functions with that release. Will leave open in case you have further changes for the jetty.xml misconfiguration issues you referenced.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Timothy Bish (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13198039#comment-13198039 ]
Timothy Bish commented on AMQ-3693:
-----------------------------------
I applied it and built locally, broker fails to start with error:
{noformat}
INFO | Refreshing org.apache.activemq.xbean.XBeanBrokerFactory$1@70453807: startup date [Wed Feb 01 13:42:31 EST 2012]; root of context hierarchy
ERROR: java.lang.RuntimeException: Failed to execute start task. Reason: org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load type: org.eclipse.jetty.http.security.Constraint. Reason: java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint; nested exception is java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint
java.lang.RuntimeException: Failed to execute start task. Reason: org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load type: org.eclipse.jetty.http.security.Constraint. Reason: java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint; nested exception is java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint
at org.apache.activemq.console.command.StartCommand.runTask(StartCommand.java:98)
at org.apache.activemq.console.command.AbstractCommand.execute(AbstractCommand.java:57)
at org.apache.activemq.console.command.ShellCommand.runTask(ShellCommand.java:148)
at org.apache.activemq.console.command.AbstractCommand.execute(AbstractCommand.java:57)
at org.apache.activemq.console.command.ShellCommand.main(ShellCommand.java:90)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.activemq.console.Main.runTaskClass(Main.java:251)
at org.apache.activemq.console.Main.main(Main.java:107)
Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Failed to load type: org.eclipse.jetty.http.security.Constraint. Reason: java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint; nested exception is java.lang.ClassNotFoundException: org.eclipse.jetty.http.security.Constraint
at org.apache.xbean.spring.context.v2c.XBeanQNameHelper.getBeanInfo(XBeanQNameHelper.java:75)
at org.apache.xbean.spring.context.v2c.XBeanQNameHelper.coerceNamespaceAwarePropertyValues(XBeanQNameHelper.java:54)
at org.apache.xbean.spring.context.v2c.XBeanBeanDefinitionParserDelegate.parseBeanDefinitionElement(XBeanBeanDefinitionParserDelegate.java:59)
at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseBeanDefinitionElement(BeanDefinitionParserDelegate.java:396)
at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseBeanDefinitionElement(BeanDefinitionParserDelegate.java:365)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.processBeanDefinition(XBeanBeanDefinitionDocumentReader.java:174)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.parseDefaultElement(XBeanBeanDefinitionDocumentReader.java:101)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.parseBeanDefinitions(XBeanBeanDefinitionDocumentReader.java:81)
at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:93)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:493)
at org.apache.xbean.spring.context.v2.XBeanXmlBeanDefinitionReader.registerBeanDefinitions(XBeanXmlBeanDefinitionReader.java:79)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:390)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.importBeanDefinitionResource(XBeanBeanDefinitionDocumentReader.java:129)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.parseDefaultElement(XBeanBeanDefinitionDocumentReader.java:95)
at org.apache.xbean.spring.context.v2.XBeanBeanDefinitionDocumentReader.parseBeanDefinitions(XBeanBeanDefinitionDocumentReader.java:81)
at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:93)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:493)
at org.apache.xbean.spring.context.v2.XBeanXmlBeanDefinitionReader.registerBeanDefinitions(XBeanXmlBeanDefinitionReader.java:79)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:390)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302)
at org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions(ResourceXmlApplicationContext.java:111)
at org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions(ResourceXmlApplicationContext.java:104)
at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:130)
at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:467)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:397)
at org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:64)
at org.apache.xbean.spring.context.ResourceXmlApplicationContext.<init>(ResourceXmlApplicationContext.java:52)
at org.apache.activemq.xbean.XBeanBrokerFactory$1.<init>(XBeanBrokerFactory.java:106)
at org.apache.activemq.xbean.XBeanBrokerFactory.createApplicationContext(XBeanBrokerFactory.java:106)
at org.apache.activemq.xbean.XBeanBrokerFactory.createBroker(XBeanBrokerFactory.java:71)
at org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:71)
at org.apache.activemq.broker.BrokerFactory.createBroker(BrokerFactory.java:54)
at org.apache.activemq.console.command.StartCommand.startBroker(StartCommand.java:115)
at org.apache.activemq.console.command.StartCommand.runTask(StartCommand.java:74)
... 10 more
{noformat}
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: upgrade-jetty.patch
Sorry about the delay, I didn't have time until now. I am attaching a new patch that fixes the problem pointed out by Tim.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: (was: upgrade-jetty.patch)
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: upgrade-jetty.patch
Updated patch to include full release of Jetty 7.6.0. I didn't realize that it had been released when I created this issue.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Bruce Snyder (Issue Comment Edited) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13197539#comment-13197539 ]
Bruce Snyder edited comment on AMQ-3693 at 2/1/12 3:06 AM:
-----------------------------------------------------------
I have attached a patch for this work, but please note that the patch was created against Jetty 7.6.0.RC4. The changes will need to use the full Jetty 7.6.0 release when that release is made available.
Is it possible to get a new version of ActiveMQ cut when Jetty 7.6.0 is released so that this CVE can be addressed right away?
was (Author: bsnyder):
I have attached a patch for this work, but please note that the patch was created against Jetty 7.6.0.RC4. The changes will need to use the full Jetty 7.6.0 release when that release is made available.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: (was: upgrade-jetty.patch)
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Timothy Bish (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13202421#comment-13202421 ]
Timothy Bish commented on AMQ-3693:
-----------------------------------
Applying the new patch and running locally, access to the AMQ web console produces large numbers of the following exception on the broker:
{noformat}
WARN | /admin/styles/prettify.css;jsessionid=16o74xc6vb13s1dc6cpufjy8de
java.lang.NullPointerException
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:514)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:227)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1031)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:406)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:186)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:965)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:117)
at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:499)
at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111)
at org.eclipse.jetty.server.Server.handle(Server.java:349)
at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:449)
at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:910)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:634)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:230)
at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:76)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:609)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:45)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:599)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:534)
at java.lang.Thread.run(Thread.java:662)
{noformat}
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Attachment: upgrade-jetty.patch
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461|CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Timothy Bish (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Timothy Bish resolved AMQ-3693.
-------------------------------
Resolution: Fixed
The main issue was resolved, jetty updated to 7.6.2. Testing shows the console and other jetty services are working now.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (AMQ-3693) Upgrade Jetty to address
CVE-2011-4461
Posted by "Bruce Snyder (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13205249#comment-13205249 ]
Bruce Snyder commented on AMQ-3693:
-----------------------------------
I have determined that the NPE is actually due to the combination of two items:
# A misconfiguration of Jetty in the jetty.xml file -- normally each web context should have its own authenticator configured. The way that the three contexts are currently configured is not correct. I'm still working through this with Greg Wilkins.
# A bug in Jetty where it should be performing a null check on the security handler for a given context:
[https://bugs.eclipse.org/bugs/show_bug.cgi?id=371162]
Greg has already fixed this bug in the Jetty master branch and will included it in the Jetty 7.6.1 release next week.
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (AMQ-3693) Upgrade Jetty to address CVE-2011-4461
Posted by "Bruce Snyder (Updated) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/AMQ-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Bruce Snyder updated AMQ-3693:
------------------------------
Description: Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes. (was: Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461|CVE-2011-4461] for more information. See also the attached patch for changes. )
> Upgrade Jetty to address CVE-2011-4461
> --------------------------------------
>
> Key: AMQ-3693
> URL: https://issues.apache.org/jira/browse/AMQ-3693
> Project: ActiveMQ
> Issue Type: Task
> Affects Versions: 5.5.1
> Reporter: Bruce Snyder
> Attachments: upgrade-jetty.patch
>
>
> Upgrade Jetty to the 7.6.0 release when it becomes final so as to address a DoS vulnerability. See the [CVE-2011-4461|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4461] for more information. See also the attached patch for changes.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira