[T2.2] Apache ActiveMQ 5.16.x hardening (32 CVEs)

[natechadwick-intsof]

Summary

ActiveMQ 5.19.x requires Java 11+; the 32 catalogued CVEs are pinned at the latest Java 1.8 line. Mitigation: in-VM broker only, empty , simpleAuthenticationPlugin with anonymousAccessAllowed=false, per-queue constantPendingMessageLimit=1000. Closing PRs: #167 (issue #166), #211, #213, #215, #217.

Mitigation matrix

See docs/SECURITY-MITIGATIONS.md T2.2 entry for the per-GAV mitigation table.

OWASP suppressions

Per-CVE entries with notes describing the mitigation are in owasp-suppressions.xml.

Closing evidence

• docs/SECURITY-MITIGATIONS.md T2.2 entry
• owasp-suppressions.xml
• Merged PR(s): fix(security): T2.2 ActiveMQ 5.16.8 hardening (issue #166) #167, fix(activemq): restore xmlns on <broker> and correct pendingMessageLimitStrategy structure #211, fix(activemq): add in-VM user credentials to simpleAuthenticationPlugin + ConnectionFactory #213, fix(activemq): use <users>/<authenticationUser> child elements #215, fix(deps): declare activemq-jaas explicitly (broker declares it as optional) #217

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73

[natechadwick-intsof]

Closing this sub-task

Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on main:

• Merged PR(s) referenced in the sub-task body
• docs/SECURITY-MITIGATIONS.md has the per-GAV mitigation table for this sub-task
• owasp-suppressions.xml has per-GAV <suppress> entries with <notes> describing the mitigation, pointing back at this issue and the merged PR(s)

No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.