2.5. Security Fixes

Fixed AMQ-4582, affecting the SSL transport cipher suites. Previously, if you specified an invalid cipher suite to the transport.enabledCipherSuites parameter on an SSL transport connector, the broker would start with all ciphers enabled.

The implementation of the JAAS authorization plug-in has been modified so that it is compatible with the Apache Karaf JAAS authentication module. This makes it possible to integrate the JAAS authorization plug-in with the Karaf JAAS authentication module when the broker is deployed in an OSGi container. For more details, see the JBoss A-MQ Security Guide.

Fixed AMQ-4520, which is caused by a bug in the default SSL provider that comes with Java 7 (affecting the Diffie-Hellman cipher suite). You can now work around this issue by adding the Bouncy Castle security producer to the Java 7 lib directory.

Removed the command agent, which is no longer needed and might potentially have exposed a security hole through the JMS protocol.