You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by ro...@apache.org on 2016/07/02 01:12:28 UTC
[34/34] qpid-site git commit: add details for the security issue
add details for the security issue
Project: http://git-wip-us.apache.org/repos/asf/qpid-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/qpid-site/commit/c3818b6e
Tree: http://git-wip-us.apache.org/repos/asf/qpid-site/tree/c3818b6e
Diff: http://git-wip-us.apache.org/repos/asf/qpid-site/diff/c3818b6e
Branch: refs/heads/asf-site
Commit: c3818b6e1ff87aa8123905cea41cef1ee87fe135
Parents: 66ad7b0
Author: Robert Gemmell <ro...@apache.org>
Authored: Sat Jul 2 02:05:42 2016 +0100
Committer: Robert Gemmell <ro...@apache.org>
Committed: Sat Jul 2 02:05:42 2016 +0100
----------------------------------------------------------------------
content/components/cpp-broker/security.html | 2 +
content/components/java-broker/security.html | 4 +-
content/components/jms/security-0-x.html | 192 +++++++++++++++++++
content/components/jms/security.html | 192 +++++++++++++++++++
content/proton/security.html | 2 +
content/releases/index.html | 4 +-
.../releases/qpid-java-6.0.4/release-notes.html | 5 +-
.../releases/qpid-jms-0.10.0/release-notes.html | 5 +-
content/security.html | 6 +-
input/components/cpp-broker/security.md | 2 +
input/components/java-broker/security.md | 4 +-
input/components/jms/security-0-x.md | 67 +++++++
input/components/jms/security.md | 67 +++++++
input/proton/security.md | 2 +
input/releases/index.md | 4 +-
input/releases/qpid-java-6.0.4/release-notes.md | 6 +-
input/releases/qpid-jms-0.10.0/release-notes.md | 7 +-
input/security.md | 10 +-
18 files changed, 559 insertions(+), 22 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/components/cpp-broker/security.html
----------------------------------------------------------------------
diff --git a/content/components/cpp-broker/security.html b/content/components/cpp-broker/security.html
index 546a269..24474f9 100644
--- a/content/components/cpp-broker/security.html
+++ b/content/components/cpp-broker/security.html
@@ -285,6 +285,8 @@ https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</section>
+<p>See the main <a href="/security.html">Security</a> page for general information and details for other components.</p>
+
<hr/>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/components/java-broker/security.html
----------------------------------------------------------------------
diff --git a/content/components/java-broker/security.html b/content/components/java-broker/security.html
index ffaf015..c6b5014 100644
--- a/content/components/java-broker/security.html
+++ b/content/components/java-broker/security.html
@@ -120,8 +120,6 @@ https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
<h2 id="java-broker">Java Broker</h2>
-<h3 id="cves">CVEs</h3>
-
<table>
<thead>
<tr>
@@ -212,6 +210,8 @@ https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</section>
+<p>See the main <a href="/security.html">Security</a> page for general information and details for other components.</p>
+
<hr/>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/components/jms/security-0-x.html
----------------------------------------------------------------------
diff --git a/content/components/jms/security-0-x.html b/content/components/jms/security-0-x.html
new file mode 100644
index 0000000..08c16e0
--- /dev/null
+++ b/content/components/jms/security-0-x.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<!--
+ -
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -
+-->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+ <head>
+ <title>Security - Apache Qpid™</title>
+ <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
+ <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+ <link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
+ <link rel="stylesheet" href="/deferred.css" type="text/css" defer="defer"/>
+ <script type="text/javascript">var _deferredFunctions = [];</script>
+ <script type="text/javascript" src="/deferred.js" defer="defer"></script>
+ <!--[if lte IE 8]>
+ <link rel="stylesheet" href="/ie.css" type="text/css"/>
+ <script type="text/javascript" src="/html5shiv.js"></script>
+ <![endif]-->
+
+ <!-- Redirects for `go get` and godoc.org -->
+ <meta name="go-import"
+ content="qpid.apache.org git https://git-wip-us.apache.org/repos/asf/qpid-proton.git"/>
+ <meta name="go-source"
+ content="qpid.apache.org
+https://github.com/apache/qpid-proton/blob/go1/README.md
+https://github.com/apache/qpid-proton/tree/go1{/dir}
+https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
+ </head>
+ <body>
+ <div id="-content">
+ <div id="-top" class="panel">
+ <a id="-menu-link"><img width="16" height="16" src="" alt="Menu"/></a>
+
+ <a id="-search-link"><img width="22" height="16" src="" alt="Search"/></a>
+
+ <ul id="-global-navigation">
+ <li><a id="-logotype" href="/index.html">Apache Qpid<sup>™</sup></a></li>
+ <li><a href="/documentation.html">Documentation</a></li>
+ <li><a href="/download.html">Download</a></li>
+ <li><a href="/discussion.html">Discussion</a></li>
+ </ul>
+ </div>
+
+ <div id="-menu" class="panel" style="display: none;">
+ <div class="flex">
+ <section>
+ <h3>Project</h3>
+
+ <ul>
+ <li><a href="/overview.html">Overview</a></li>
+ <li><a href="/components/index.html">Components</a></li>
+ <li><a href="/releases/index.html">Releases</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Messaging APIs</h3>
+
+ <ul>
+ <li><a href="/proton/index.html">Qpid Proton</a></li>
+ <li><a href="/components/jms/index.html">Qpid JMS</a></li>
+ <li><a href="/components/messaging-api/index.html">Qpid Messaging API</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Servers and tools</h3>
+
+ <ul>
+ <li><a href="/components/java-broker/index.html">Java broker</a></li>
+ <li><a href="/components/cpp-broker/index.html">C++ broker</a></li>
+ <li><a href="/components/dispatch-router/index.html">Dispatch router</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Resources</h3>
+
+ <ul>
+ <li><a href="/dashboard.html">Dashboard</a></li>
+ <li><a href="https://cwiki.apache.org/confluence/display/qpid/Index">Wiki</a></li>
+ <li><a href="/resources.html">More resources</a></li>
+ </ul>
+ </section>
+ </div>
+ </div>
+
+ <div id="-search" class="panel" style="display: none;">
+ <form action="http://www.google.com/search" method="get">
+ <input type="hidden" name="sitesearch" value="qpid.apache.org"/>
+ <input type="text" name="q" maxlength="255" autofocus="autofocus" tabindex="1"/>
+ <button type="submit">Search</button>
+ <a href="/search.html">More ways to search</a>
+ </form>
+ </div>
+
+ <div id="-middle" class="panel">
+ <ul id="-path-navigation"><li><a href="/index.html">Home</a></li><li><a href="/components/index.html">Components</a></li><li><a href="/components/jms/index.html">Qpid JMS</a></li><li>Security</li></ul>
+
+ <div id="-middle-content">
+ <h1 id="security">Security</h1>
+
+<section>
+
+<h2 id="amqp-0-x-jms-client-amqp-0-8-0-9-0-9-1-0-10">AMQP 0-x JMS Client (AMQP 0-8, 0-9, 0-9-1, 0-10)</h2>
+
+<table>
+ <thead>
+ <tr>
+ <th>CVE-ID</th><th>Severity</th><th>Affected Versions</th><th>Fixed in Versions</th><th>Description</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td>CVE-2016-4974</td>
+ <td>Moderate</td>
+ <td>6.0.3 and earlier</td>
+ <td>6.0.4 and later</a></td>
+ <td>
+ Deserialization of untrusted input while using JMS ObjectMessage. <a id="CVE-2016-4974_details_toggle" href="javascript:_toggleDiv({divId:'CVE-2016-4974_details', controlId:'CVE-2016-4974_details_toggle', showMore:'<small>show more</small>', showLess:'<small>show less</small>'});"><small>show more</small></a>
+ <div style="display:none;" id="CVE-2016-4974_details">
+ <p>Description: When applications call getObject() on a consumed JMS ObjectMessage they are
+ subject to the behaviour of any object deserialization during the process
+ of constructing the body to return. Unless the application has taken outside
+ steps to limit the deserialization process, they can't protect against
+ input that might try to make undesired use of classes available on the
+ application classpath that might be vulnerable to exploitation.</p>
+
+ <p> Mitigation: Users using ObjectMessage can upgrade to Qpid
+ AMQP 0-x JMS client 6.0.4 or or later, and use the new
+ configuration options to whitelist trusted content permitted for
+ deserialization. When so configured, attempts to deserialize input
+ containing other content will be prevented. Alternatively, users of older
+ client releases may utilise other means such as agent-based approaches to help
+ govern content permitted for deserialization in their application.</p>
+
+ <p> Credit: This issue was discovered by Matthias Kaiser of Code White (www.code-white.com)</p>
+
+ <p>References: <a href="https://issues.apache.org/jira/browse/QPID-7323">QPID-7323</a></p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</section>
+
+<p>See the main <a href="/security.html">Security</a> page for general information and details for other components.</p>
+
+
+ <hr/>
+
+ <ul id="-apache-navigation">
+ <li><a href="http://www.apache.org/">Apache</a></li>
+ <li><a href="http://www.apache.org/licenses/">License</a></li>
+ <li><a href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</a></li>
+ <li><a href="http://www.apache.org/foundation/thanks.html">Thanks!</a></li>
+ <li><a href="/security.html">Security</a></li>
+ <li><a href="http://www.apache.org/"><img id="-apache-feather" width="48" height="14" src="" alt="Apache"/></a></li>
+ </ul>
+
+ <p id="-legal">
+ Apache Qpid, Messaging built on AMQP; Copyright © 2015
+ The Apache Software Foundation; Licensed under
+ the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache
+ License, Version 2.0</a>; Apache Qpid, Qpid, Qpid Proton,
+ Proton, Apache, the Apache feather logo, and the Apache Qpid
+ project logo are trademarks of The Apache Software
+ Foundation; All other marks mentioned may be trademarks or
+ registered trademarks of their respective owners
+ </p>
+ </div>
+ </div>
+ </div>
+ </body>
+</html>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/components/jms/security.html
----------------------------------------------------------------------
diff --git a/content/components/jms/security.html b/content/components/jms/security.html
new file mode 100644
index 0000000..a6fb6d4
--- /dev/null
+++ b/content/components/jms/security.html
@@ -0,0 +1,192 @@
+<!DOCTYPE html>
+<!--
+ -
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -
+-->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+ <head>
+ <title>Security - Apache Qpid™</title>
+ <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
+ <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
+ <link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
+ <link rel="stylesheet" href="/deferred.css" type="text/css" defer="defer"/>
+ <script type="text/javascript">var _deferredFunctions = [];</script>
+ <script type="text/javascript" src="/deferred.js" defer="defer"></script>
+ <!--[if lte IE 8]>
+ <link rel="stylesheet" href="/ie.css" type="text/css"/>
+ <script type="text/javascript" src="/html5shiv.js"></script>
+ <![endif]-->
+
+ <!-- Redirects for `go get` and godoc.org -->
+ <meta name="go-import"
+ content="qpid.apache.org git https://git-wip-us.apache.org/repos/asf/qpid-proton.git"/>
+ <meta name="go-source"
+ content="qpid.apache.org
+https://github.com/apache/qpid-proton/blob/go1/README.md
+https://github.com/apache/qpid-proton/tree/go1{/dir}
+https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
+ </head>
+ <body>
+ <div id="-content">
+ <div id="-top" class="panel">
+ <a id="-menu-link"><img width="16" height="16" src="" alt="Menu"/></a>
+
+ <a id="-search-link"><img width="22" height="16" src="" alt="Search"/></a>
+
+ <ul id="-global-navigation">
+ <li><a id="-logotype" href="/index.html">Apache Qpid<sup>™</sup></a></li>
+ <li><a href="/documentation.html">Documentation</a></li>
+ <li><a href="/download.html">Download</a></li>
+ <li><a href="/discussion.html">Discussion</a></li>
+ </ul>
+ </div>
+
+ <div id="-menu" class="panel" style="display: none;">
+ <div class="flex">
+ <section>
+ <h3>Project</h3>
+
+ <ul>
+ <li><a href="/overview.html">Overview</a></li>
+ <li><a href="/components/index.html">Components</a></li>
+ <li><a href="/releases/index.html">Releases</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Messaging APIs</h3>
+
+ <ul>
+ <li><a href="/proton/index.html">Qpid Proton</a></li>
+ <li><a href="/components/jms/index.html">Qpid JMS</a></li>
+ <li><a href="/components/messaging-api/index.html">Qpid Messaging API</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Servers and tools</h3>
+
+ <ul>
+ <li><a href="/components/java-broker/index.html">Java broker</a></li>
+ <li><a href="/components/cpp-broker/index.html">C++ broker</a></li>
+ <li><a href="/components/dispatch-router/index.html">Dispatch router</a></li>
+ </ul>
+ </section>
+
+ <section>
+ <h3>Resources</h3>
+
+ <ul>
+ <li><a href="/dashboard.html">Dashboard</a></li>
+ <li><a href="https://cwiki.apache.org/confluence/display/qpid/Index">Wiki</a></li>
+ <li><a href="/resources.html">More resources</a></li>
+ </ul>
+ </section>
+ </div>
+ </div>
+
+ <div id="-search" class="panel" style="display: none;">
+ <form action="http://www.google.com/search" method="get">
+ <input type="hidden" name="sitesearch" value="qpid.apache.org"/>
+ <input type="text" name="q" maxlength="255" autofocus="autofocus" tabindex="1"/>
+ <button type="submit">Search</button>
+ <a href="/search.html">More ways to search</a>
+ </form>
+ </div>
+
+ <div id="-middle" class="panel">
+ <ul id="-path-navigation"><li><a href="/index.html">Home</a></li><li><a href="/components/index.html">Components</a></li><li><a href="/components/jms/index.html">Qpid JMS</a></li><li>Security</li></ul>
+
+ <div id="-middle-content">
+ <h1 id="security">Security</h1>
+
+<section>
+
+<h2 id="jms-client-amqp-10">JMS Client (AMQP 1.0)</h2>
+
+<table>
+ <thead>
+ <tr>
+ <th>CVE-ID</th><th>Severity</th><th>Affected Versions</th><th>Fixed in Versions</th><th>Description</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td>CVE-2016-4974</td>
+ <td>Moderate</td>
+ <td>0.9.0 and earlier</td>
+ <td>0.10.0 and later</a></td>
+ <td>
+ Deserialization of untrusted input while using JMS ObjectMessage. <a id="CVE-2016-4974_details_toggle" href="javascript:_toggleDiv({divId:'CVE-2016-4974_details', controlId:'CVE-2016-4974_details_toggle', showMore:'<small>show more</small>', showLess:'<small>show less</small>'});"><small>show more</small></a>
+ <div style="display:none;" id="CVE-2016-4974_details">
+ <p>Description: When applications call getObject() on a consumed JMS ObjectMessage they are
+ subject to the behaviour of any object deserialization during the process
+ of constructing the body to return. Unless the application has taken outside
+ steps to limit the deserialization process, they can't protect against
+ input that might try to make undesired use of classes available on the
+ application classpath that might be vulnerable to exploitation.</p>
+
+ <p> Mitigation: Users using ObjectMessage can upgrade to
+ Qpid JMS client 0.10.0 or later, and use the new
+ configuration options to whitelist trusted content permitted for
+ deserialization. When so configured, attempts to deserialize input
+ containing other content will be prevented. Alternatively, users of older
+ client releases may utilise other means such as agent-based approaches to help
+ govern content permitted for deserialization in their application.</p>
+
+ <p> Credit: This issue was discovered by Matthias Kaiser of Code White (www.code-white.com)</p>
+
+ <p>References: <a href="https://issues.apache.org/jira/browse/QPIDJMS-188">QPIDJMS-188</a></p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</section>
+
+<p>See the main <a href="/security.html">Security</a> page for general information and details for other components.</p>
+
+
+ <hr/>
+
+ <ul id="-apache-navigation">
+ <li><a href="http://www.apache.org/">Apache</a></li>
+ <li><a href="http://www.apache.org/licenses/">License</a></li>
+ <li><a href="http://www.apache.org/foundation/sponsorship.html">Sponsorship</a></li>
+ <li><a href="http://www.apache.org/foundation/thanks.html">Thanks!</a></li>
+ <li><a href="/security.html">Security</a></li>
+ <li><a href="http://www.apache.org/"><img id="-apache-feather" width="48" height="14" src="" alt="Apache"/></a></li>
+ </ul>
+
+ <p id="-legal">
+ Apache Qpid, Messaging built on AMQP; Copyright © 2015
+ The Apache Software Foundation; Licensed under
+ the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache
+ License, Version 2.0</a>; Apache Qpid, Qpid, Qpid Proton,
+ Proton, Apache, the Apache feather logo, and the Apache Qpid
+ project logo are trademarks of The Apache Software
+ Foundation; All other marks mentioned may be trademarks or
+ registered trademarks of their respective owners
+ </p>
+ </div>
+ </div>
+ </div>
+ </body>
+</html>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/proton/security.html
----------------------------------------------------------------------
diff --git a/content/proton/security.html b/content/proton/security.html
index 0685c05..90401d1 100644
--- a/content/proton/security.html
+++ b/content/proton/security.html
@@ -177,6 +177,8 @@ https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</section>
+<p>See the main <a href="/security.html">Security</a> page for general information and details for other components.</p>
+
<hr/>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/releases/index.html
----------------------------------------------------------------------
diff --git a/content/releases/index.html b/content/releases/index.html
index 322867e..569e311 100644
--- a/content/releases/index.html
+++ b/content/releases/index.html
@@ -124,10 +124,10 @@ the
<h2 id="current-releases">Current releases</h2>
<ul>
-<li><a href="qpid-jms-0.9.0/index.html">Qpid JMS 0.10.0</a>, July 2016</li>
+<li><a href="qpid-jms-0.10.0/index.html">Qpid JMS 0.10.0</a>, July 2016</li>
<li><a href="qpid-java-6.0.4/index.html">Qpid Java 6.0.4</a>, July 2016</li>
<li><a href="qpid-proton-0.13.0/index.html">Qpid Proton 0.13.0</a>, June 2016</li>
-<li><a href="qpid-dispatch-0.5/index.html">Qpid Dispatch 0.6</a>, June 2016</li>
+<li><a href="qpid-dispatch-0.6.0/index.html">Qpid Dispatch 0.6.0</a>, June 2016</li>
<li><a href="qpid-cpp-0.34/index.html">Qpid C++ 0.34</a>, June 2015</li>
<li><a href="qpid-0.32/index.html">Qpid 0.32</a>, March 2015</li>
</ul>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/releases/qpid-java-6.0.4/release-notes.html
----------------------------------------------------------------------
diff --git a/content/releases/qpid-java-6.0.4/release-notes.html b/content/releases/qpid-java-6.0.4/release-notes.html
index 9217fff..3bbdafc 100644
--- a/content/releases/qpid-java-6.0.4/release-notes.html
+++ b/content/releases/qpid-java-6.0.4/release-notes.html
@@ -123,12 +123,15 @@ using AMQP.</p>
<p>For more information about this release, including download links and
documentation, see the <a href="index.html">release overview</a>.</p>
+<p><strong>Note</strong>: This release addresses a security vulnerability in the JMS client,
+CVE-2016-4974, see the <a href="/security.html">Security</a> pages for more details.</p>
+
<h2 id="new-features-and-improvements">New features and improvements</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/QPID-7291">QPID-7291</a> - [Java Broker] [Documentation] Add documentation for ManagedCertificateStore and SiteSpecificTrustStore</li>
<li><a href="https://issues.apache.org/jira/browse/QPID-7305">QPID-7305</a> - [Java Broker] Queue operations copy/move/delete should take an optional JMS selector argument</li>
-<li><a href="https://issues.apache.org/jira/browse/QPID-7323">QPID-7323</a> - [Java Client] Improvements to the ObjectMessage implementation</li>
+<li><a href="https://issues.apache.org/jira/browse/QPID-7323">QPID-7323</a> - [CVE-2016-4974] [Java Client] add whitelisting of trusted content for deserialization from ObjectMessage</li>
</ul>
<h2 id="bugs-fixed">Bugs fixed</h2>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/releases/qpid-jms-0.10.0/release-notes.html
----------------------------------------------------------------------
diff --git a/content/releases/qpid-jms-0.10.0/release-notes.html b/content/releases/qpid-jms-0.10.0/release-notes.html
index 0a40244..2da3922 100644
--- a/content/releases/qpid-jms-0.10.0/release-notes.html
+++ b/content/releases/qpid-jms-0.10.0/release-notes.html
@@ -123,6 +123,9 @@ engine.</p>
<p>For more information about this release, including download links and
documentation, see the <a href="index.html">release overview</a>.</p>
+<p><strong>Note</strong>: This release addresses a security vulnerability in the JMS client,
+CVE-2016-4974, see the <a href="/security.html">Security</a> pages for more details.</p>
+
<h2 id="new-features-and-improvements">New features and improvements</h2>
<ul>
@@ -132,7 +135,7 @@ documentation, see the <a href="index.html">release overview</a>.</p>
<li><a href="https://issues.apache.org/jira/browse/QPIDJMS-176">QPIDJMS-176</a> - Cleanup creation of the anonymous fallback producer when remote does not support anonymous relay.</li>
<li><a href="https://issues.apache.org/jira/browse/QPIDJMS-177">QPIDJMS-177</a> - Make the policy objects used in the client more extensable and give more control over their controlled behaviors</li>
<li><a href="https://issues.apache.org/jira/browse/QPIDJMS-185">QPIDJMS-185</a> - update to Proton 0.13.0</li>
-<li><a href="https://issues.apache.org/jira/browse/QPIDJMS-188">QPIDJMS-188</a> - Further ObjectMessage improvements</li>
+<li><a href="https://issues.apache.org/jira/browse/QPIDJMS-188">QPIDJMS-188</a> - [CVE-2016-4974] allow whitelisting trusted content for deserialization from ObjectMessage</li>
</ul>
<h2 id="bugs-fixed">Bugs fixed</h2>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/content/security.html
----------------------------------------------------------------------
diff --git a/content/security.html b/content/security.html
index 3fb5ea0..0688b3b 100644
--- a/content/security.html
+++ b/content/security.html
@@ -120,8 +120,8 @@ https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
<h2 id="security-updates">Security Updates</h2>
-<p>Lists of security problems fixed in released versions of the Apache
-Qpid are available for each Component separately:</p>
+<p>Details of security problems fixed in released versions of individual Apache
+Qpid components are detailed at:</p>
<div class="flex">
@@ -137,6 +137,8 @@ Qpid are available for each Component separately:</p>
<section>
<ul>
+<li><a href="/components/jms/security.html">JMS Client (AMQP 1.0)</a></li>
+<li><a href="/components/jms/security-0-x.html">JMS Client (AMQP 0.x)</a></li>
<li><a href="/proton/security.html">Proton</a></li>
</ul>
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/components/cpp-broker/security.md
----------------------------------------------------------------------
diff --git a/input/components/cpp-broker/security.md b/input/components/cpp-broker/security.md
index 5c80935..c705fb5 100644
--- a/input/components/cpp-broker/security.md
+++ b/input/components/cpp-broker/security.md
@@ -187,3 +187,5 @@
</table>
</section>
+
+See the main [Security]({{site_url}}/security.html) page for general information and details for other components.
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/components/java-broker/security.md
----------------------------------------------------------------------
diff --git a/input/components/java-broker/security.md b/input/components/java-broker/security.md
index 6ac1d92..0e0792a 100644
--- a/input/components/java-broker/security.md
+++ b/input/components/java-broker/security.md
@@ -23,8 +23,6 @@
## Java Broker
-### CVEs
-
<table>
<thead>
<tr>
@@ -114,3 +112,5 @@
</table>
</section>
+
+See the main [Security]({{site_url}}/security.html) page for general information and details for other components.
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/components/jms/security-0-x.md
----------------------------------------------------------------------
diff --git a/input/components/jms/security-0-x.md b/input/components/jms/security-0-x.md
new file mode 100644
index 0000000..ed6417a
--- /dev/null
+++ b/input/components/jms/security-0-x.md
@@ -0,0 +1,67 @@
+;;
+;; Licensed to the Apache Software Foundation (ASF) under one
+;; or more contributor license agreements. See the NOTICE file
+;; distributed with this work for additional information
+;; regarding copyright ownership. The ASF licenses this file
+;; to you under the Apache License, Version 2.0 (the
+;; "License"); you may not use this file except in compliance
+;; with the License. You may obtain a copy of the License at
+;;
+;; http://www.apache.org/licenses/LICENSE-2.0
+;;
+;; Unless required by applicable law or agreed to in writing,
+;; software distributed under the License is distributed on an
+;; "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+;; KIND, either express or implied. See the License for the
+;; specific language governing permissions and limitations
+;; under the License.
+;;
+
+# Security
+
+<section markdown="1">
+
+## AMQP 0-x JMS Client (AMQP 0-8, 0-9, 0-9-1, 0-10)
+
+<table>
+ <thead>
+ <tr>
+ <th>CVE-ID</th><th>Severity</th><th>Affected Versions</th><th>Fixed in Versions</th><th>Description</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td>CVE-2016-4974</td>
+ <td>Moderate</td>
+ <td>6.0.3 and earlier</td>
+ <td>6.0.4 and later</a></td>
+ <td>
+ Deserialization of untrusted input while using JMS ObjectMessage. <a id="CVE-2016-4974_details_toggle" href="javascript:_toggleDiv({divId:'CVE-2016-4974_details', controlId:'CVE-2016-4974_details_toggle', showMore:'<small>show more</small>', showLess:'<small>show less</small>'});"><small>show more</small></a>
+ <div style="display:none;" id="CVE-2016-4974_details">
+ <p>Description: When applications call getObject() on a consumed JMS ObjectMessage they are
+ subject to the behaviour of any object deserialization during the process
+ of constructing the body to return. Unless the application has taken outside
+ steps to limit the deserialization process, they can't protect against
+ input that might try to make undesired use of classes available on the
+ application classpath that might be vulnerable to exploitation.</p>
+
+ <p> Mitigation: Users using ObjectMessage can upgrade to Qpid
+ AMQP 0-x JMS client 6.0.4 or or later, and use the new
+ configuration options to whitelist trusted content permitted for
+ deserialization. When so configured, attempts to deserialize input
+ containing other content will be prevented. Alternatively, users of older
+ client releases may utilise other means such as agent-based approaches to help
+ govern content permitted for deserialization in their application.</p>
+
+ <p> Credit: This issue was discovered by Matthias Kaiser of Code White (www.code-white.com)</p>
+
+ <p>References: <a href="https://issues.apache.org/jira/browse/QPID-7323">QPID-7323</a></p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</section>
+
+See the main [Security]({{site_url}}/security.html) page for general information and details for other components.
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/components/jms/security.md
----------------------------------------------------------------------
diff --git a/input/components/jms/security.md b/input/components/jms/security.md
new file mode 100644
index 0000000..bc0c4b6
--- /dev/null
+++ b/input/components/jms/security.md
@@ -0,0 +1,67 @@
+;;
+;; Licensed to the Apache Software Foundation (ASF) under one
+;; or more contributor license agreements. See the NOTICE file
+;; distributed with this work for additional information
+;; regarding copyright ownership. The ASF licenses this file
+;; to you under the Apache License, Version 2.0 (the
+;; "License"); you may not use this file except in compliance
+;; with the License. You may obtain a copy of the License at
+;;
+;; http://www.apache.org/licenses/LICENSE-2.0
+;;
+;; Unless required by applicable law or agreed to in writing,
+;; software distributed under the License is distributed on an
+;; "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+;; KIND, either express or implied. See the License for the
+;; specific language governing permissions and limitations
+;; under the License.
+;;
+
+# Security
+
+<section markdown="1">
+
+## JMS Client (AMQP 1.0)
+
+<table>
+ <thead>
+ <tr>
+ <th>CVE-ID</th><th>Severity</th><th>Affected Versions</th><th>Fixed in Versions</th><th>Description</th>
+ </tr>
+ </thead>
+ <tbody>
+ <tr>
+ <td>CVE-2016-4974</td>
+ <td>Moderate</td>
+ <td>0.9.0 and earlier</td>
+ <td>0.10.0 and later</a></td>
+ <td>
+ Deserialization of untrusted input while using JMS ObjectMessage. <a id="CVE-2016-4974_details_toggle" href="javascript:_toggleDiv({divId:'CVE-2016-4974_details', controlId:'CVE-2016-4974_details_toggle', showMore:'<small>show more</small>', showLess:'<small>show less</small>'});"><small>show more</small></a>
+ <div style="display:none;" id="CVE-2016-4974_details">
+ <p>Description: When applications call getObject() on a consumed JMS ObjectMessage they are
+ subject to the behaviour of any object deserialization during the process
+ of constructing the body to return. Unless the application has taken outside
+ steps to limit the deserialization process, they can't protect against
+ input that might try to make undesired use of classes available on the
+ application classpath that might be vulnerable to exploitation.</p>
+
+ <p> Mitigation: Users using ObjectMessage can upgrade to
+ Qpid JMS client 0.10.0 or later, and use the new
+ configuration options to whitelist trusted content permitted for
+ deserialization. When so configured, attempts to deserialize input
+ containing other content will be prevented. Alternatively, users of older
+ client releases may utilise other means such as agent-based approaches to help
+ govern content permitted for deserialization in their application.</p>
+
+ <p> Credit: This issue was discovered by Matthias Kaiser of Code White (www.code-white.com)</p>
+
+ <p>References: <a href="https://issues.apache.org/jira/browse/QPIDJMS-188">QPIDJMS-188</a></p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</section>
+
+See the main [Security]({{site_url}}/security.html) page for general information and details for other components.
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/proton/security.md
----------------------------------------------------------------------
diff --git a/input/proton/security.md b/input/proton/security.md
index e18ffb6..ab1633d 100644
--- a/input/proton/security.md
+++ b/input/proton/security.md
@@ -79,3 +79,5 @@
</table>
</section>
+
+See the main [Security]({{site_url}}/security.html) page for general information and details for other components.
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/releases/index.md
----------------------------------------------------------------------
diff --git a/input/releases/index.md b/input/releases/index.md
index cfb211c..6149235 100644
--- a/input/releases/index.md
+++ b/input/releases/index.md
@@ -26,10 +26,10 @@ the
## Current releases
- - [Qpid JMS 0.10.0](qpid-jms-0.9.0/index.html), July 2016
+ - [Qpid JMS 0.10.0](qpid-jms-0.10.0/index.html), July 2016
- [Qpid Java 6.0.4](qpid-java-6.0.4/index.html), July 2016
- [Qpid Proton 0.13.0](qpid-proton-0.13.0/index.html), June 2016
- - [Qpid Dispatch 0.6](qpid-dispatch-0.5/index.html), June 2016
+ - [Qpid Dispatch 0.6.0](qpid-dispatch-0.6.0/index.html), June 2016
- [Qpid C++ 0.34](qpid-cpp-0.34/index.html), June 2015
- [Qpid 0.32](qpid-0.32/index.html), March 2015
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/releases/qpid-java-6.0.4/release-notes.md
----------------------------------------------------------------------
diff --git a/input/releases/qpid-java-6.0.4/release-notes.md b/input/releases/qpid-java-6.0.4/release-notes.md
index d29dbde..3f8ff79 100644
--- a/input/releases/qpid-java-6.0.4/release-notes.md
+++ b/input/releases/qpid-java-6.0.4/release-notes.md
@@ -26,12 +26,14 @@ using AMQP.
For more information about this release, including download links and
documentation, see the [release overview](index.html).
+**Note**: This release addresses a security vulnerability in the JMS client,
+CVE-2016-4974, see the [Security]({{site_url}}/security.html) pages for more details.
## New features and improvements
- [QPID-7291](https://issues.apache.org/jira/browse/QPID-7291) - [Java Broker] [Documentation] Add documentation for ManagedCertificateStore and SiteSpecificTrustStore
- [QPID-7305](https://issues.apache.org/jira/browse/QPID-7305) - [Java Broker] Queue operations copy/move/delete should take an optional JMS selector argument
- - [QPID-7323](https://issues.apache.org/jira/browse/QPID-7323) - [Java Client] Improvements to the ObjectMessage implementation
+ - [QPID-7323](https://issues.apache.org/jira/browse/QPID-7323) - [CVE-2016-4974] [Java Client] add whitelisting of trusted content for deserialization from ObjectMessage
## Bugs fixed
@@ -40,4 +42,4 @@ documentation, see the [release overview](index.html).
- [QPID-7290](https://issues.apache.org/jira/browse/QPID-7290) - [Java Broker] [WMC] Incorrect title on 'Add TrustStore' dialog
- [QPID-7298](https://issues.apache.org/jira/browse/QPID-7298) - [Java Broker] [0-8..0-91] Broker sends unsolicited ExchangeDeclareOk in response to declares of exchanges with reserved names
- [QPID-7301](https://issues.apache.org/jira/browse/QPID-7301) - [Java Client] [Java Broker] JMS Selector parsing will not fail if a valid selector is followed by invalid text
- - [QPID-7313](https://issues.apache.org/jira/browse/QPID-7313) - [Java Broker] Connection close REST request can hang when client application does not reply with ConnectionCloseOk to broker ConnectionClose command
\ No newline at end of file
+ - [QPID-7313](https://issues.apache.org/jira/browse/QPID-7313) - [Java Broker] Connection close REST request can hang when client application does not reply with ConnectionCloseOk to broker ConnectionClose command
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/releases/qpid-jms-0.10.0/release-notes.md
----------------------------------------------------------------------
diff --git a/input/releases/qpid-jms-0.10.0/release-notes.md b/input/releases/qpid-jms-0.10.0/release-notes.md
index 3ee3822..849ed29 100644
--- a/input/releases/qpid-jms-0.10.0/release-notes.md
+++ b/input/releases/qpid-jms-0.10.0/release-notes.md
@@ -26,6 +26,9 @@ engine.
For more information about this release, including download links and
documentation, see the [release overview](index.html).
+**Note**: This release addresses a security vulnerability in the JMS client,
+CVE-2016-4974, see the [Security]({{site_url}}/security.html) pages for more details.
+
[jms]: http://en.wikipedia.org/wiki/Java_Message_Service
@@ -37,7 +40,7 @@ documentation, see the [release overview](index.html).
- [QPIDJMS-176](https://issues.apache.org/jira/browse/QPIDJMS-176) - Cleanup creation of the anonymous fallback producer when remote does not support anonymous relay.
- [QPIDJMS-177](https://issues.apache.org/jira/browse/QPIDJMS-177) - Make the policy objects used in the client more extensable and give more control over their controlled behaviors
- [QPIDJMS-185](https://issues.apache.org/jira/browse/QPIDJMS-185) - update to Proton 0.13.0
- - [QPIDJMS-188](https://issues.apache.org/jira/browse/QPIDJMS-188) - Further ObjectMessage improvements
+ - [QPIDJMS-188](https://issues.apache.org/jira/browse/QPIDJMS-188) - [CVE-2016-4974] allow whitelisting trusted content for deserialization from ObjectMessage
## Bugs fixed
@@ -50,4 +53,4 @@ documentation, see the [release overview](index.html).
## Tasks
- [QPIDJMS-171](https://issues.apache.org/jira/browse/QPIDJMS-171) - Remove configuration options that were deprecated in 0.7.0
- - [QPIDJMS-174](https://issues.apache.org/jira/browse/QPIDJMS-174) - Update ActiveMQ dependency to 5.13.3
\ No newline at end of file
+ - [QPIDJMS-174](https://issues.apache.org/jira/browse/QPIDJMS-174) - Update ActiveMQ dependency to 5.13.3
http://git-wip-us.apache.org/repos/asf/qpid-site/blob/c3818b6e/input/security.md
----------------------------------------------------------------------
diff --git a/input/security.md b/input/security.md
index c2fa8f4..52b0541 100644
--- a/input/security.md
+++ b/input/security.md
@@ -23,23 +23,21 @@
## Security Updates
-Lists of security problems fixed in released versions of the Apache
-Qpid are available for each Component separately:
+Details of security problems fixed in released versions of individual Apache
+Qpid components are detailed at:
<div class="flex" markdown="1">
<section markdown="1">
- [Java Broker]({{site_url}}/components/java-broker/security.html)
- [C++ Broker]({{site_url}}/components/cpp-broker/security.html)
-;; - [Dispatch Router]({{site_url}}/components/dispatch-router/security.html)
</section>
<section markdown="1">
+ - [JMS Client (AMQP 1.0)]({{site_url}}/components/jms/security.html)
+ - [JMS Client (AMQP 0.x)]({{site_url}}/components/jms/security-0-x.html)
- [Proton]({{site_url}}/proton/security.html)
-;; - [JMS Client (AMQP 1.0)]({{site_url}}/components/jms/security-1.0.html)
-;; - [JMS Client (AMQP 0.x)]({{site_url}}/components/jms/security-0-x.html)
-;; - [Messaging API]({{site_url}}/components/messaging-api/security.html)
</section>
</div>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org