ActiveMQ Classic 5.16.1 Release

Apache ActiveMQ Classic 5.16.1 was released on Jan 20th, 2021. It fully supports JDK 9+ at runtime and includes several resolved issues and bug fixes.

This release addresses the following CVEs:

• CVE-2021-26117: LDAP-Authentication does not verify passwords on servers with anonymous bind.
• CVE-2020-13947: XSS in WebConsole.

Getting the Binary Distributions

Java compatibility: 8+

Verify the Integrity of Downloads

It is essential that you verify the integrity of the downloaded files using the PGP signature or SHA checksum.

The PGP signatures can be verified using PGP or GPG. Begin by following these steps:

1. Download the KEYS file.
2. Download the .asc signature for the relevant distribution file.
3. Verify the signature using one the following sets of commands, depending on your use of PGP or GPG:

   $ gpg --import KEYS
   $ gpg --verify <file-name>.asc <file-name>
   
   $ pgpk -a KEYS
   $ pgpv <file-name>.asc
   
   $ pgp -ka KEYS
   $ pgp <file-name>.asc
   

Alternatively you can [also] verify the SHA-512 checksum of the file. For example, using the sha512sum command:

$ sha512sum -c <file-name>.sha512

Getting the Binaries using Maven 3

To use this release in your maven project, the simplest dependency that you can use in your Maven POM is:

<dependency>
  <groupId>org.apache.activemq</groupId>
  <artifactId>activemq-all</artifactId>
  <version>5.16.1</version>
</dependency>

If you need more fine grained control of your dependencies (activemq-all is an uber jar) pick and choose from the various components activemq-client, activemq-broker, activemq-xx-store etc.

Getting the Source Code

Source Distributions

Change Log

For a more detailed view of new features and bug fixes, see the release notes

Also see the previous ActiveMQ Classic 5.16.0 Release