[AMQ-7399] SERIALIZABLE_PACKAGES should exclude java* by default

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.15.10, 5.15.11
• Fix Version/s: 5.16.0, 5.15.12
• Component/s: Broker
• Assignee: Jean-Baptiste Onofré
• Reporter: Jean-Baptiste Onofré
• Created: 07/Feb/20 04:24
• Updated: 09/Dec/20 07:49
• Resolved: 14/Feb/20 07:23

Description

To avoid potential security issue when using ObjectMessage, SERIALIZABLE_PACKAGE should be limited by default. Now, it contains java.lang, ...

Issue Links

• relates to: AMQ-8097 Harden deserialization block xstream ack processing
• links to: GitHub Pull Request #446
• links to: GitHub Pull Request #453