[AMQ-5160] Wildcard subscriptions bypass Authentication / Authorization

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 5.9.1
• Fix Version/s: 5.10.0
• Component/s: MQTT
• Labels: authentication authorization mqtt security
• Assignee: Dejan Bosanac
• Reporter: Surf
• Created: 23/Apr/14 21:03
• Updated: 01/Jul/15 22:13
• Resolved: 26/May/14 09:29

Description

I am using MQTT on AMQ 5.9.1
After latest MQTT hardening from dhirajsb , there is an issue of MQTT retained messages.

Simple case:
Set Authentication / Authorization for two different TOPICS.
Send retained message to one topic.

Try to subscribe "#" with other second user.
It will show retained messages published by TOPIC 1.

here i have attached test configurations.

Issue Links

• is related to: AMQ-5814 Wrong with role-based authorization when using right permission