activemq-messages-dequeud-but-not-consumed

2019独角兽企业重金招聘Python工程师标准>>>

ObjectMessage serialization security was the issue.

ObjectMessage objects depend on Java serialization of marshal/unmarshal object payload. This process is generally considered unsafe as malicious payload can exploit the host system. That's why starting with versions 5.12.2 and 5.13.0, ActiveMQ enforces users to explicitly whitelist packages that can be exchanged using ObjectMessages.

I saw this a few days ago and added a white list but it didn't fix the issue. I also tried running against AMQ 5.11.3 and it didn't work. Apparently they added the security feature to 5.11.3 too. Anyway, I added this (-Dorg.apache.activemq.SERIALIZABLE_PACKAGES="*") to the client side and AMQ vm arguments and now everything is working as it should.

Keep in mind that the command line option I used is a security vulnerability that I've explicitly opened in my broker, which can allow a malicious user to execute code on my system. The right way to use that flag is to explicitly list the classes you allow to be deserialized, or at most use package wildcards to avoid explicitly listing individual classes and subpackages in a trusted parent package.

转载于:https://my.oschina.net/fastjrun/blog/625636

activemq-messages-dequeud-but-not-consumed相关推荐

ActiveMQ 学习(VM Transport)
http://jinguo.iteye.com/blog/233947 1 JMS 在介绍ActiveMQ之前,首先简要介绍一下JMS规范. 1．1 JMS的基本构件 1．1．1 连接工厂连接工厂是 ...
Log4j.xml配置日志按级别过滤并将指定级别的日志发送到ActiveMQ
为什么80%的码农都做不了架构师?>>> 在之前的一篇博客<Spring+Log4j+ActiveMQ实现远程记录日志--实战+分析>的评论中,有同学提到这种方式应 ...
linux activemq 打印日志,Log4j.xml配置日志按级别过滤并将指定级别的日志发送到ActiveMQ...
目标:将debug,info级别的日志输出到本地文件,将warn,error级别的日志输出到ActiveMQ. 说明:本文还是使用之前的两个项目:Product和Logging. 经过一番搜索后,发现 ...
AciveMQ小结|最后有视频
1 JMS 在介绍ActiveMQ之前,首先简要介绍一下JMS规范. 1.1 JMS的基本构件 1．1．1 连接工厂连接工厂是客户用来创建连接的对象,例如ActiveMQ提供的ActiveMQCon ...
activemq之Messages Enqueued、Messages Dequeued
启动activemq后,我们可以通过登录activemq管理页面查看上述信息,需要注意的是Messages Dequeued与Messages Enqueued是会随着activemq服务端的启动清零 ...
activemq 管理后台 Number Of Pending Messages、Number Of Consumers、Messages Enqueued、Messages Dequeued的意思
Number Of Consumers :表示消费者数量: Number Of Pending Messages :等待消费的消息,这个是当前未出队列的数量: Messages Enqueued :进 ...
ActiveMq生产者流量控制（Producer Flow Control）
最近学习ActiveMq,昨日查看其配置文件activemq.xml的时候,被一行注释引到了http://activemq.apache.org/producer-flow-control.html页 ...
JMS学习（三）ActiveMQ Message Persistence（转）
1,JMS规范支持两种类型的消息传递:persistent and non-persistent.ActiveMQ在支持这两种类型的传递方式时,还支持消息的恢复.中间状态的消息(message are ...
Spring ActiveMQ示例（第2部分）
This is the second part in the Spring ActiveMQ example tutorial. Please head over to the first part ...
ActiveMQ应用笔记四：Ajax应用
环境: apache-activemq-5.8.0 Tomcat7.0.29 jdk1.7.0_03 win7 eclipse(Version: Helios Service Release 2Bui ...

activemq-messages-dequeud-but-not-consumed

activemq-messages-dequeud-but-not-consumed相关推荐

最新文章

热门文章