Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace ActiveMQ docker image with security vulnerabilities #155

Merged
merged 1 commit into from
Feb 9, 2024

Conversation

backmari
Copy link
Contributor

@backmari backmari commented Feb 9, 2024

Short description of the changes:

When deploying WebMon to the test environment Randy got a security exception in the ActiveMQ broker deployment, due to the dependency log4j1.2.17. "the security scan is saying we need log4j 2.16 or later"

This change replaces the ActiveMQ broker docker image from the archived repo https://github.com/rmohr/docker-activemq with an official ActiveMQ docker image from Apache: https://hub.docker.com/r/apache/activemq-classic.

The new broker uses a log4j version > 2.16:

# find / -type f -name log4*
/opt/apache-activemq/lib/optional/log4j-slf4j2-impl-2.22.0.jar
/opt/apache-activemq/lib/optional/log4j-core-2.22.0.jar
/opt/apache-activemq/lib/optional/log4j-api-2.22.0.jar
/opt/apache-activemq/examples/openwire/advanced-scenarios/jms-example-queue/src/main/resources/log4j2.properties
/opt/apache-activemq/examples/openwire/advanced-scenarios/jms-example-topic/src/main/resources/log4j2.properties
/opt/apache-activemq/examples/conf/log4j2.properties
/opt/apache-activemq/conf/log4j2.properties

Check list for the pull request

  • I have read the [CONTRIBUTING]
  • I have read the [CODE_OF_CONDUCT]
  • I have added tests for my changes
  • I have updated the documentation accordingly

Check list for the reviewer

  • I have read the [CONTRIBUTING]
  • I have verified the proposed changes
  • best software practices
    • all internal functions have an underbar, as is python standard
    • clearly named variables (better to be verbose in variable names)
    • code comments explaining the intent of code blocks
  • All the tests are passing
  • The documentation is up to date
  • code comments added when explaining intent

References

Defect 3940: Replace ActiveMQ docker image

Copy link
Member

@peterfpeterson peterfpeterson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes are reasonable and the system tests are still connected and passing

@backmari backmari merged commit 57a7f75 into next Feb 9, 2024
4 checks passed
@backmari backmari deleted the docker_activemq branch February 9, 2024 19:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants