JMS Appender broker password should be a char[], not a String.
This is a known potential security issue.