Skip to navigation

Security Advisory Moderate: Red Hat Enterprise MRG Messaging 2.3 security update

Advisory: RHSA-2013:0561-1
Type: Security Advisory
Severity: Moderate
Issued on: 2013-03-06
Last updated on: 2013-03-06
Affected Products: Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 5)
CVEs (cve.mitre.org): CVE-2012-4446
CVE-2012-4458
CVE-2012-4459

Details

Updated Messaging component packages that fix multiple security issues,
several bugs, and add various enhancements are now available for Red Hat
Enterprise MRG 2.3 for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation
IT infrastructure for enterprise computing. MRG offers increased
performance, reliability, interoperability, and faster computing for
enterprise customers.

MRG Messaging is a high-speed reliable messaging distribution for Linux
based on AMQP (Advanced Message Queuing Protocol), an open protocol
standard for enterprise messaging that is designed to make mission critical
messaging widely available as a standard service, and to make enterprise
messaging interoperable across platforms, programming languages, and
vendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10
client libraries for C++, Java JMS, and Python; as well as persistence
libraries and management tools.

It was found that the Apache Qpid daemon (qpidd) treated AMQP connections
with the federation_tag attribute set as a broker-to-broker connection,
rather than a client-to-server connection. This resulted in the source user
ID of messages not being checked. A client that can establish an AMQP
connection with the broker could use this flaw to bypass intended
authentication. For Condor users, if condor-aviary is installed, this flaw
could be used to submit jobs that would run as any user (except root, as
Condor does not run jobs as root). (CVE-2012-4446)

It was found that the AMQP type decoder in qpidd allowed arbitrary data
types in certain messages. A remote attacker could use this flaw to send a
message containing an excessively large amount of data, causing qpidd to
allocate a large amount of memory. qpidd would then be killed by the Out of
Memory killer (denial of service). (CVE-2012-4458)

An integer overflow flaw, leading to an out-of-bounds read, was found in
the Qpid qpid::framing::Buffer::checkAvailable() function. An
unauthenticated, remote attacker could send a specially-crafted message to
Qpid, causing it to crash. (CVE-2012-4459)

The CVE-2012-4446, CVE-2012-4458, and CVE-2012-4459 issues were discovered
by Florian Weimer of the Red Hat Product Security Team.

This update also fixes several bugs and adds enhancements. Documentation
for these changes will be available shortly from the Technical Notes
document linked to in the References section.

All users of the Messaging capabilities of Red Hat Enterprise MRG are
advised to upgrade to these updated packages, which resolve these issues,
and fix the bugs and add the enhancements noted in the Red Hat Enterprise
MRG 2 Technical Notes. After installing the updated packages, stop the
cluster by either running "service qpidd stop" on all nodes, or
"qpid-cluster --all-stop" on any one of the cluster nodes. Once stopped,
restart the cluster with "service qpidd start" on all nodes for the update
to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise MRG v2 for Red Hat Enterprise Linux (version 5)

SRPMS:
cumin-messaging-0.1.1-2.el5.src.rpm     MD5: d3727f8933c84d4fa7ceada1c1cabfec
SHA-256: e97e2ee16b8f7b6ba19adb2deceaf3d3b41d12bf94cf2a09c93348dd62452289
mrg-release-2.3.0-1.el5.src.rpm
File outdated by:  RHSA-2014:0261
    MD5: e49994c4d1a3acdb115afa2d9ba640ec
SHA-256: 7d736ce66f86689af7bced80322954ef6f9394a0aef4e360f04c7c773f26d39d
python-qpid-0.18-4.el5.src.rpm
File outdated by:  RHBA-2014:0129
    MD5: eee24f03b105de59e214ae5528da8d22
SHA-256: dfd89363a9c0410b1faf3eb0fdef96402b74b0ecad3482f9b7ae320482192b00
qpid-cpp-mrg-0.18-14.el5.src.rpm
File outdated by:  RHBA-2014:0129
    MD5: 50d9340dec000057977d275286a55617
SHA-256: b94c26d4ec87cab5c2862da94204c48f001c0d7cc3037a397d3d0a64c03e9a8b
qpid-java-0.18-7.el5.src.rpm
File outdated by:  RHBA-2013:1023
    MD5: 929625956c50c349a25f609eeb4e9e91
SHA-256: 0580966170231a720078facff57007ddf2482c8a4f9e2079a04ef5507363f4c1
qpid-jca-0.18-8.el5.src.rpm     MD5: eae820c3404f129a2c0f15bf12240866
SHA-256: d14169c6a218b6b77f52079b41a67303b8ef1fa2ba75a1168f1fdd61ac2dc74e
qpid-qmf-0.18-15.el5.src.rpm
File outdated by:  RHBA-2014:0129
    MD5: 968edd8c28b4ad5c88cf72c3d2936682
SHA-256: d8a6125f4cc969c8a63422cfac3639ea9fa809473d7b15f4807381d897740225
qpid-tests-0.18-2.el5.src.rpm     MD5: 88e477ee5a3ea83a8c528af15a2da3f9
SHA-256: 27f2460f95ca7415525a4440dc6171f368c1aa992e305686b9b127cf53572c71
qpid-tools-0.18-8.el5.src.rpm
File outdated by:  RHBA-2013:1023
    MD5: c549129c0ea5a57a8b0974223cacb65d
SHA-256: 393ecb5772e5891c09a30a99a8eabe841d80b1459bce8a6b71b23c301e822645
rhm-docs-0.18-2.el5.src.rpm     MD5: 1e9a84af9a2c90fc5bea373569439950
SHA-256: b6c4003ac00a2f510bff0c825516076e475b22cb4b3d5d9dafe879c12a0d36dc
saslwrapper-0.18-1.el5.src.rpm     MD5: 44f1824693518262a65a668862ae8918
SHA-256: 7f99f70ce260ae041c29edc2622b6ac315a44888db6aae464abe1b7b92eabbca
 
IA-32:
cumin-messaging-0.1.1-2.el5.noarch.rpm     MD5: 4ae925719ebaba68508a9b163c5870a3
SHA-256: 95975db7bc24d37b36e45c736679f62a57e1c545ad19a7c7fe68bb8e3786eb0e
mrg-release-2.3.0-1.el5.noarch.rpm
File outdated by:  RHSA-2014:0261
    MD5: 62924b6f410ff9b62a73cfca25cb7645
SHA-256: c8d35e9d17db28dd5c7e22387d705a49dfc7b6aaa9af3547833147b81375db7c
python-qpid-0.18-4.el5.noarch.rpm
File outdated by:  RHBA-2014:0129
    MD5: e31c358348ba4821163d367757f7f329
SHA-256: 443d0f9b69f96d15064a3b95500b1e2e78b187189d63120db6f2d223aa7bc11b
python-qpid-qmf-0.18-15.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 03f964aeed26eb2c78ca4bb27299f360
SHA-256: 7a73cee79de46c442647e0c399ad3709727d47c63276190da69839b2b62a7020
python-saslwrapper-0.18-1.el5.i386.rpm     MD5: 9e1b4a1f3938cb572c6d4977879c7446
SHA-256: fc41f96ff054f9ded519f7cbcb110226746e6b26a9edc12f7b4d037637c68b1f
qpid-cpp-client-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 230e01328db80bdf09c0b102110b0f6e
SHA-256: 1c141508396f1563d03c982ac16ab3829f7fedac05627202874d1e4de7f4cef9
qpid-cpp-client-devel-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: e10672c8359d34d885d77c8cae4ea73b
SHA-256: 5eb74b47ddc2662c959792ae737770350c3cdc2fdc09ba9512c4779ad9732e20
qpid-cpp-client-devel-docs-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 660922cae633598b457534955bfa72ff
SHA-256: a647816924d8d725f0ac61b5bcf8ed504c1b9122079b4563488ff8b78705e294
qpid-cpp-client-rdma-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 2cc4423073dd8e5caf0bcada63ef656b
SHA-256: 76ee9c44bd7fd9a3a4f08ab8a803bd386584e006f590a690f3f204c9e2b44782
qpid-cpp-client-ssl-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 36f068ff0420e7f583929d17155154d3
SHA-256: 65341038c74920eae2d5b094514abab5bdeffa0a6bb2ff701a5d91807d5eb3d7
qpid-cpp-server-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 9df2bec0b22270499725942c4de94a9d
SHA-256: d8dbec4d523f650afd95075cc105a6b043f5572da0f7086a2527f5616d89d09f
qpid-cpp-server-cluster-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 8d333db0266e998c68e57bbfd6bf913a
SHA-256: 9367d623ced4ed9235865342c2006d5d797f949bb38b10b08612c2f6dbff7ea7
qpid-cpp-server-devel-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 1b3afc5876966569e22358da39155fdd
SHA-256: d9cdc06f01f76981e0ca81f6ff8d4f3d6f3e34a47cb6ac292d40f4ab41aced3d
qpid-cpp-server-rdma-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 3bd3e89243d9ada70d41bc0027369d9e
SHA-256: aacc176564ab4f3f8744afe769a6f375b53545ca9ae5b1d076a585b5471a37dc
qpid-cpp-server-ssl-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 1be684e4842becb132d3df3cfe69fd8d
SHA-256: 8f1661641e8fa8c84e3e583d4755db7e30e18c48a82a3442b83d72ba17af6ae2
qpid-cpp-server-store-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 5cdd0ac011422fb7f9cf6bc179ba3730
SHA-256: b7ab5fdf546c63a51cf18da01ba113eeaca753003c0ada6bb700bf952415307e
qpid-cpp-server-xml-0.18-14.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: a7d81fc6149b9654fbc8e717ddc4975b
SHA-256: 1469fed2b46c5d482ac190bb4ce7721251d76bf836edae41780d012f253c88fe
qpid-java-client-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: 798e93dfe9560b1828f7217838bad2b3
SHA-256: 9a26a1c2bd7bcfb6e1b004014955860c5c7db688dd646a69fc5dcbbad172b44e
qpid-java-common-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: 412443711f1cd5cd6406be9076fe4655
SHA-256: b654a346e8769996f334434bd2940983c4f38b91d578db7fd1d936ba5b7579a8
qpid-java-example-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: d932144b7f20f506c467655ba32fe403
SHA-256: 5d3dfffadaebb19d3c8a2a1fc9d112b4bd3bd023c21deae834867d447614ff91
qpid-jca-0.18-8.el5.noarch.rpm     MD5: 4e5cbe05fda312d1de3d0cd6521d7437
SHA-256: 1a90bdb69a68321348b44cd4e4e84ce9f74c350b80bad0ffa0b24a4f6c7d3ecd
qpid-jca-xarecovery-0.18-8.el5.noarch.rpm     MD5: b95431b38696c6d314db2407c551f4de
SHA-256: ac266939362b320ba8a8653fd82ee148b4e5b52517ca8bd1e51918b0ba3b972f
qpid-qmf-0.18-15.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: c2745b7d6bd4d48d9bc185ec784e6063
SHA-256: 8823210306ae58737a95379a76465f561b97818ba0726ba7781739cc6c32ede6
qpid-qmf-devel-0.18-15.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: b85d31db034973a3e13e5da5cea8753c
SHA-256: d1bf242774378bd96ed7aafe597c3550aa440f65a7b3bb5a1b712befe75c43f5
qpid-tests-0.18-2.el5.noarch.rpm     MD5: 5eb3e1d49c9fba08183f97ba572c38cf
SHA-256: 3f792f93daa47d5c685343cbec04f7ba2f69f4cc5029127a5be7f778f3bd35a9
qpid-tools-0.18-8.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: ab8aae2e74f7e570e96d62a4bbf331f1
SHA-256: c33c685a75a5a3b5587ac30f0059f0862540bca14c9933b28fca1191930b18ae
rhm-docs-0.18-2.el5.noarch.rpm     MD5: a9785c46d0a14a77abb884b413181fbf
SHA-256: 19af919b40a351ec03c458c4e8bd13809de2c3b940a98786524f69816606b0b1
ruby-qpid-qmf-0.18-15.el5.i386.rpm
File outdated by:  RHBA-2014:0129
    MD5: 9580cdabc74c4a3fc34204b115385eb8
SHA-256: 6a958f0f3b548a3d7f2e438b58c5ded69c597d17d73aba83a96be98b2d6dc0f0
ruby-saslwrapper-0.18-1.el5.i386.rpm     MD5: db03ab28788041c81cbdf21bb869794a
SHA-256: 2a5d2067c469015e5e26a83bcb8ebf3a33b4d0c45c8451c98e97c1a7beeb1f1e
saslwrapper-0.18-1.el5.i386.rpm     MD5: 0520241deef2ceaed133440757ff4535
SHA-256: da4b4a756ea411edb57f0e24a690330d174db3f6e119ac61c7f2f659431bca25
saslwrapper-devel-0.18-1.el5.i386.rpm     MD5: a99f825308138c06f33098eb273e2ce8
SHA-256: ee7f767b27e43eb68972345c38695d75436a2b186849f82c48a0c3d59a067e3b
 
x86_64:
cumin-messaging-0.1.1-2.el5.noarch.rpm     MD5: 4ae925719ebaba68508a9b163c5870a3
SHA-256: 95975db7bc24d37b36e45c736679f62a57e1c545ad19a7c7fe68bb8e3786eb0e
mrg-release-2.3.0-1.el5.noarch.rpm
File outdated by:  RHSA-2014:0261
    MD5: 62924b6f410ff9b62a73cfca25cb7645
SHA-256: c8d35e9d17db28dd5c7e22387d705a49dfc7b6aaa9af3547833147b81375db7c
python-qpid-0.18-4.el5.noarch.rpm
File outdated by:  RHBA-2014:0129
    MD5: e31c358348ba4821163d367757f7f329
SHA-256: 443d0f9b69f96d15064a3b95500b1e2e78b187189d63120db6f2d223aa7bc11b
python-qpid-qmf-0.18-15.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: ec46f8daafe9bd1b592a83c12dd572b0
SHA-256: 2c7bc73609342abc560f7db04b4da41479de5e8a6b20e313773a42919a86cbdf
python-saslwrapper-0.18-1.el5.x86_64.rpm     MD5: ccfa4e2dbd7aa92c84b1acbaa0a053e9
SHA-256: 72009bc3fc2cb7d7f2d5ea02cd42a3c5fde143726bea1968b0cb48bc89f09f0a
qpid-cpp-client-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: e313bb9bf355bff15afb26f3b528becd
SHA-256: bd76d0b0b3c8aeca18478fce4f7ef0b57973f68198683bd46a9fa837ef302a82
qpid-cpp-client-devel-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: c2c35edd240faa63939d997c6aae1986
SHA-256: ffa77bcabd21e97de4edd68b7773d4ac3b5df2270981c1df35c62c7ce6ff5b02
qpid-cpp-client-devel-docs-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: ab915ae773cfe4be938e2e2117f72000
SHA-256: b677596008ca83d9c1ef05426bf77af76aa1de4285193e48cdafcfdebbee12a5
qpid-cpp-client-rdma-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 8b3e053bdc810d9c765ebd26e9123031
SHA-256: 627ea710847ae17707945034fa335153bd1ee5c87a6e5fc9c46999771556f0e2
qpid-cpp-client-ssl-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 52cb78901dfea52531e7c6feea9779da
SHA-256: b0f5e678df3e6761a860c9e3e4ac16b306aabf607ae6bee442c40db11080a003
qpid-cpp-server-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 8766236c4d2c7f3dfaba61c79afa0b9e
SHA-256: b1217bcd9470d9492ed5b02d7e5803bf237548145cb4e6cb1c2afa99ba9437d7
qpid-cpp-server-cluster-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 63d0fc958851349c3e87a46168d4d34b
SHA-256: 74a825e11b6952bd4fe0feeb1b1310383535f346b17af542db6a16a017cd8722
qpid-cpp-server-devel-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 0f14164564f5e31776385e191430d216
SHA-256: f31803d754f5f30e0129da5df69445f2dbcb13f62197dc4dc600de78ecbf3bc8
qpid-cpp-server-rdma-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 0579229bf9e70bb8c5b421283417876c
SHA-256: 5ec7174719e3e1885f3bf046e7573ed846939dca20aca05d3677bd34ce4a2fca
qpid-cpp-server-ssl-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: c7d021e75ca83a83cb9a8f6e1e249146
SHA-256: 7316e6e84a95f98f3694cf6b29718cb5d021521e5ea90257b0aadf1252eb2833
qpid-cpp-server-store-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: e3fd37a5ba93bd13abba66bfd59ea5cc
SHA-256: bfc99615dd2b5fd5dcbe31d8d78bd51b950db7f419525b18775d908d3f1d77ca
qpid-cpp-server-xml-0.18-14.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 23292081a90c32888d7c7ffa787168cf
SHA-256: cf664e6ac20db1d7562728eee43b77abb4a154ec8d82657c80dc2c9908fc16f2
qpid-java-client-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: 798e93dfe9560b1828f7217838bad2b3
SHA-256: 9a26a1c2bd7bcfb6e1b004014955860c5c7db688dd646a69fc5dcbbad172b44e
qpid-java-common-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: 412443711f1cd5cd6406be9076fe4655
SHA-256: b654a346e8769996f334434bd2940983c4f38b91d578db7fd1d936ba5b7579a8
qpid-java-example-0.18-7.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: d932144b7f20f506c467655ba32fe403
SHA-256: 5d3dfffadaebb19d3c8a2a1fc9d112b4bd3bd023c21deae834867d447614ff91
qpid-jca-0.18-8.el5.noarch.rpm     MD5: 4e5cbe05fda312d1de3d0cd6521d7437
SHA-256: 1a90bdb69a68321348b44cd4e4e84ce9f74c350b80bad0ffa0b24a4f6c7d3ecd
qpid-jca-xarecovery-0.18-8.el5.noarch.rpm     MD5: b95431b38696c6d314db2407c551f4de
SHA-256: ac266939362b320ba8a8653fd82ee148b4e5b52517ca8bd1e51918b0ba3b972f
qpid-qmf-0.18-15.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 95ea33683e21d2486ef4949740b71b1e
SHA-256: 9af4347c1696ceda129765668548869063c8537f3dab54ac2d3167660c9b9ae8
qpid-qmf-devel-0.18-15.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 9fb910e9bb37329a534a6945a3a9b364
SHA-256: 2b028a957065781fe5a5566c035e6ca40f490971b7c380d3128c7b1b96a0f8ba
qpid-tests-0.18-2.el5.noarch.rpm     MD5: 5eb3e1d49c9fba08183f97ba572c38cf
SHA-256: 3f792f93daa47d5c685343cbec04f7ba2f69f4cc5029127a5be7f778f3bd35a9
qpid-tools-0.18-8.el5.noarch.rpm
File outdated by:  RHBA-2013:1023
    MD5: ab8aae2e74f7e570e96d62a4bbf331f1
SHA-256: c33c685a75a5a3b5587ac30f0059f0862540bca14c9933b28fca1191930b18ae
rhm-docs-0.18-2.el5.noarch.rpm     MD5: a9785c46d0a14a77abb884b413181fbf
SHA-256: 19af919b40a351ec03c458c4e8bd13809de2c3b940a98786524f69816606b0b1
ruby-qpid-qmf-0.18-15.el5.x86_64.rpm
File outdated by:  RHBA-2014:0129
    MD5: 6a0c12a7f7a62294bb041b96be8828a6
SHA-256: ad577679c9793cb6912a994f5f2e3610d9d3085894fed3c4ed3702a1aaffff41
ruby-saslwrapper-0.18-1.el5.x86_64.rpm     MD5: f02101b0d2857f60fe4ac15cba898617
SHA-256: e09cbf9a8d79a95bbb1b398a89f368ca07c395d1f86c2afde279bf6775bba19a
saslwrapper-0.18-1.el5.x86_64.rpm     MD5: 9eedb506601ac2931d6110353adb7c7a
SHA-256: 7b928d6c9f8b7f14b53b63147b729622ea587b9129b7c62858997e8f4a474301
saslwrapper-devel-0.18-1.el5.x86_64.rpm     MD5: fcc8f517b734c13647175e051a911713
SHA-256: 1f8914925d1ae47b7290fb0bd908b297af9135f26ab97961a842a1cc0622e66b
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

678612 - service qpidd stop [failed] - with --log-to-stdout yes
710787 - Client doesn't completely honor reconnect=false Connection option
720714 - Clustered broker exits with invalid-argument error after attempting to create dynamic federation bridge
737685 - Acquired messages are not sent to alternate exchange when queue is deleted and receiver's session closed
740485 - qpid-stat is unable to get info from a remote host
754990 - qpidd broker ring queue limit depth working differently with --default-queue-limit=0 vs. default
773719 - Concurrent queue bind on the same queue results in crash
781496 - Incorrect timestamp returned by query method call
782806 - [RFE] Python qpid client ssl support
783215 - An error shall be raised rather than purge of messages when rerouting to alt-exchange and alt-exchange doesn't exist
784957 - Qpid broker ACL processing produces unexpected results
786555 - qpid-config add queue <existing_queue_name> returns success.
790004 - Cluster URL option does not contain IPv6 addresses by default
800912 - qpid-perftest stucks when iterations>1 and npubs<nsubs
801605 - Non-responsive peer in federated link can result in entire cluster shutdown
804752 - TransportFailure exception deadlock
813742 - queue replication fails when org.apache.qpid.example.Spout is used
814356 - createSender() ignores 'create: never'
834256 - Alternate exchange is not applied when defined in the link properties
846465 - sasl mech list overhaul
849788 - ERD 4.1.3: Acl-1000-6, Substitution symbol for the actual user name in an ACL
849790 - ERD 4.1.3: Acl-1000-8, An API for "If I tried this, would it be allowed"
851355 - CVE-2012-4446 qpid-cpp: qpid authentication bypass
856299 - Sender.send(timeout=N) should pass timeout=N to self.sync()
860011 - JMS client: node binding not created for topic node
861234 - CVE-2012-4458 qpid-cpp: long arrays of zero-width types cause a denial of service
861241 - CVE-2012-4459 qpid-cpp: crash due to qpid::framing::Buffer::checkAvailable() wraparound
861838 - Broker can delete a dynamic bridge upon error instead of attempting to recover
866677 - [RFE] Improved broker logging for expired messages
868403 - Channel collision on federated link after creating/deleting ~64K bridges
868881 - qpidd logging: too many JournalInactive messages by default - request for logging level change info -> debug or change periodicity
870058 - qpidd --config <directory> hangs during startup
871774 - Browser may read messages acquired by other consumer on message group queue
876193 - No exception on creating already existing broker object (but declaring it as different type)
876664 - Some change in exception handling
877081 - Broker crash re-routing messages through a header exchange
877553 - Crash traced to generated QMF code
882243 - Failover doesn't work properly with XA
884036 - testConversionsFromString c++ unit test failing
888392 - QpidConnectionFactoryProxy Should Implement Queue/TopicConnectionFactory Interfaces
893980 - Timeout waiting for sync on declaring queue/topic with the same identifier
895535 - 'ssl_key' connection option is not working as expected


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/