Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
MIME-Version: 1.0
Sender: chubrilo@gmail.com
In-Reply-To: 
 <CAGB5yN=vz8OTtCpyJQcreNRdQQs=AVk-O9-ZzNM5AujuBWb7xw@mail.gmail.com>
References: 
 <CACHnxzyw7NdAZFo0XJGox8gmL+8EAWHhhNdyNVCpdOnT=oDgUQ@mail.gmail.com>
	<CAKChZ-Qkma6Lb9cyb=hx9zFAtsx-S4_trRswdUOrWkG6Mrg6YQ@mail.gmail.com>
	<CAGB5yN=vz8OTtCpyJQcreNRdQQs=AVk-O9-ZzNM5AujuBWb7xw@mail.gmail.com>
Date: Mon, 7 Dec 2015 11:04:21 +0100
Message-ID: 
 <CAGeh-pHWAffgS6Rt_A-=4K+jL=fX9t1CSuRsYwo-MnriQcxOyQ@mail.gmail.com>
Subject: Re: [ANNOUNCE] Apache ActiveMQ 5.13.0 Released
From: Dejan Bosanac <dejan@nighttale.net>
To: "dev@activemq.apache.org" <dev@activemq.apache.org>
Content-Type: multipart/alternative; boundary=089e01634c2a27bfca05264bfbc2

--089e01634c2a27bfca05264bfbc2
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Claus,

restrictions were necessary for the CVE that was reported. We=E2=80=99re ab=
out to
disclose it fully now after the release.

AFAIK the change should not affect ObjectMessages in general, just the
cases where those objects are serialized/unserialized inside of the broker,
like web console or stomp transformations. I=E2=80=99ll create a proper doc=
s for
the change now and the security aspect of it and we can see later whet else
we can do to improve the user experience.

Are there any Camel related tests that fails due to this change? I can take
a look at that as well.


Regards
--
Dejan Bosanac
about.me/dejanb

On Sat, Dec 5, 2015 at 11:19 AM, Claus Ibsen <claus.ibsen@gmail.com> wrote:

> I really think you guys should add something about those object
> serialization resitrcitions. Any end users that uses java objects over
> JMS is affected. Nothing works anymore.
>
> Its because of
> https://issues.apache.org/jira/browse/AMQ-6013
>
> So there should be some text in the release notes, and ideally AMQ
> broker / client should have some kind of INFO logging that openwire
> with objects is restricted or not. Otherwise its even harder for end
> users to spot what is going on.
>
>
>
> On Fri, Dec 4, 2015 at 3:57 PM, Timothy Bish <tabish121@gmail.com> wrote:
> > It's probably a good idea to add a new page in the "New Features" secti=
on
> > on the site to cover the additions in 5.13.0.  I know you added the
> 'auto'
> > transport along with some other work for some additional metrics etc, a=
ll
> > good things that would be nice to advertise a bit.
> >
> > See: http://activemq.apache.org/new-features.html
> >
> > On Thu, Dec 3, 2015 at 3:51 PM, Christopher Shannon <
> > christopher.l.shannon@gmail.com> wrote:
> >
> >> Hi everyone,
> >>
> >> Apache ActiveMQ 5.13.0 has now been released.
> >>
> >> This release contains a number of resolved issues and new features sin=
ce
> >> the 5.12.1 release.
> >>
> >> A list of issues resolved in this release is available here:
> >>
> >>
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=3D123112=
10&version=3D12329848
> >>
> >> The Wiki page for the release is here:
> >> http://activemq.apache.org/activemq-5130-release.html
> >>
> >> API documentation for 5.12.1 is located here:
> >> http://activemq.apache.org/maven/5.13.0/apidocs/index.html
> >>
> >
> >
> >
> > --
> > --
> > Tim Bish
>
>
>
> --
> Claus Ibsen
> -----------------
> http://davsclaus.com @davsclaus
> Camel in Action 2: https://www.manning.com/ibsen2
>

--089e01634c2a27bfca05264bfbc2--