Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/artemis
main @ 0dc7dc3
6
Fixes
15
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
artemis-cli: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The STOMP protocol handler bypassed central ServerSession authorization during address and queue auto-creation. Sibling protocols must be reviewed to ensure they delegate auto-creation validation uniformly to prevent unauthorized queue manipulation.
Auth Bypass: The OIDCLoginModule failed to retrieve and verify client certificates via callbacks when requireOAuth2MTLS was false, letting certificate-bound JWT tokens bypass verification. This represents a critical breakdown in token-bound authentication.
Auth Bypass: OpenWire protocol handled non-durable JMS topic subscriptions without proper auto-creation and authorization checks, allowing unauthorized users to establish topic subscriptions when auto-creation was disabled.