| Key: |
AMQ-1272
|
| Type: |
Bug
|
| Status: |
Reopened
|
| Priority: |
Major
|
| Assignee: |
Unassigned
|
| Reporter: |
Tom Samplonius
|
| Votes: |
1
|
| Watchers: |
2
|
|
If you were logged in you would be able to see more operations.
|
|
|
|
File Attachments:
|
|
|
Environment:
|
4.2-SNAPSHOT
|
|
Issue Links:
|
dependent
|
|
|
|
This issue is depended upon by:
|
|
|
|
|
|
|
|
ActiveMQ does not correctly validate the username and password of Stomp clients. A security exception is generated, but ignored, leaving the client connected, and with full and unrestricted access to ActiveMQ.
Further description, and a partial patch:
http://www.nabble.com/Getting-Stomp-support-to-a-usable-state...-tf3858629s2354.html#a11060452
BTW, while the patch in the above post, is crude, however, leaving unauthenticated users connected with full-access makes ActiveMQ and Stomp pretty unusable. So please apply the path, rather than do nothing.
|
|
Description
|
ActiveMQ does not correctly validate the username and password of Stomp clients. A security exception is generated, but ignored, leaving the client connected, and with full and unrestricted access to ActiveMQ.
Further description, and a partial patch:
http://www.nabble.com/Getting-Stomp-support-to-a-usable-state...-tf3858629s2354.html#a11060452
BTW, while the patch in the above post, is crude, however, leaving unauthenticated users connected with full-access makes ActiveMQ and Stomp pretty unusable. So please apply the path, rather than do nothing. |
Show » |
made changes - 12/Jun/07 02:48 AM
| Field |
Original Value |
New Value |
|
Affects Version/s
|
|
5.0.0
[ 11712
]
|
made changes - 23/Jun/07 11:02 PM
|
Attachment
|
|
stomp.diff
[ 15548
]
|
made changes - 23/Jul/07 05:16 AM
|
Priority
|
Blocker
[ 1
]
|
Major
[ 3
]
|
made changes - 19/Aug/07 10:43 PM
|
Fix Version/s
|
4.1.2
[ 11801
]
|
|
|
Fix Version/s
|
|
5.1.0
[ 11802
]
|
|
Fix Version/s
|
5.0.0
[ 11712
]
|
|
made changes - 16/Dec/07 12:13 PM
|
Link
|
|
This issue is depended upon by AMQ-998
[ AMQ-998
]
|
made changes - 20/Dec/07 06:39 AM
|
Status
|
Open
[ 1
]
|
Resolved
[ 5
]
|
|
Resolution
|
|
Fixed
[ 1
]
|
made changes - 25/Aug/08 06:31 AM
|
Status
|
Resolved
[ 5
]
|
Reopened
[ 4
]
|
|
Resolution
|
Fixed
[ 1
]
|
|
made changes - 25/Aug/08 06:39 AM
made changes - 10/Sep/08 05:11 AM
|
Fix Version/s
|
5.1.0
[ 11802
]
|
|
|
Fix Version/s
|
|
5.3.0
[ 11914
]
|
made changes - 25/Jun/09 02:22 AM
|
Fix Version/s
|
5.3.0
[ 11914
]
|
|
|
Fix Version/s
|
|
4.1.3
[ 11901
]
|
made changes - 04/Sep/09 11:52 AM
|
Fix Version/s
|
4.1.3
[ 11901
]
|
|
|
Fix Version/s
|
|
5.4.0
[ 12110
]
|
|
Stomp protocol does not correctly check authentication (security hole)
