This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 4e853962abb9ddb4f22d1c4d47d591aeafa09784 Author: Robert Lazarski <[email protected]> AuthorDate: Mon Sep 7 16:08:45 2026 -1000 Say on the home page that 2.0.2 is a security release Also records why the context externalization machinery stays. AXIS2-6107 scoped its removal and it should not be done: SessionContext is an HttpSession attribute that containers serialize when persisting sessions, EndpointReference round trips only because its custom externalization handles Axiom values that are not serializable, and persisting a paused MessageContext is a capability rather than dead code. SECURITY.md item 4 now carries those three reasons so a scan finding here has a citable answer instead of being re-argued. The Rampart paragraph also still promised to ship after 2.0.1. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- SECURITY.md | 23 +++++++++++++++++++++++ src/site/xdoc/index.xml | 17 +++++++++++++++-- 2 files changed, 38 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 4a7f5de377..d49379573b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -321,6 +321,29 @@ migration from `commons-fileupload` 1.x to `commons-fileupload2` in when an integrator persists or replicates contexts, and deserializing attacker-influenced bytes stays dangerous whatever is configured here. + **Why the machinery is not simply deleted.** Clustering was the reason it + was written and clustering is gone (item 5), so removing it is the obvious + next question and scanners will keep asking it. It was scoped in + AXIS2-6107 and deliberately not done, for three reasons that are worth + recording so the question does not need re-answering: + + - `SessionContext` is stored as an `HttpSession` attribute + (`AxisServletListener`), and servlet containers serialize session + attributes when they persist sessions across a restart. That has nothing + to do with clustering, so its serializability is load-bearing today. + - `EndpointReference` carries Axiom `OMElement` and `OMAttribute` values, + which are not serializable. Custom externalization is *why* it round + trips at all, and `EndpointReferenceTypeTest` asserts that contract. + Replacing it means writing new Axiom-aware serialization code, which is + more XML-specific machinery, not less. + - Persisting a paused `MessageContext` and resuming it later is a + capability, exercised by `PausingHandlerExecutionTest`. Removing the + externalization removes the capability, not just dead code. + + The mitigation above is therefore the answer rather than deletion: the + proxy refusal and the scoped filter bound what these streams will accept, + and nothing reaches them from the network. + 5. **Clustering removed:** The entire clustering module (Tribes-based inter-node communication with unvalidated deserialization) has been removed from the codebase. diff --git a/src/site/xdoc/index.xml b/src/site/xdoc/index.xml index e9a4e7e9fc..ed296cc605 100644 --- a/src/site/xdoc/index.xml +++ b/src/site/xdoc/index.xml @@ -47,8 +47,21 @@ where a JVM cannot run. The same MCP client connects to both Axis2/Java (enterprise) and Axis2/C (embedded) with identical protocol and identical results. See the <a href="https://axis.apache.org/axis2/c/core/";>Axis2/C site</a> for details.</p> +<p><strong>Apache Axis2/Java 2.0.2 is a security release.</strong> Most of its +content comes from security reports and from security reviews of the code, and +several defaults now refuse what earlier versions allowed: decoupled +WS-Addressing responses, service dispatch from the SOAP body namespace, and the +administration console's shipped credentials. Request bodies, multiref +resolution and metadata exposure are bounded or gated as well. Every change has +a documented way to restore the previous behaviour where a deployment genuinely +needs it, collected in the <em>Upgrading from 2.0.1</em> section of the +<a href="release-notes/2.0.2.html">2.0.2 release notes</a> — read that +section before upgrading rather than after. Advisories for the reported issues +are published after the release, which is this project's normal order. +<code>SECURITY.md</code> in the source distribution carries the threat model, +including what is deliberately <em>not</em> covered.</p> <p><strong>Apache Rampart 2.0.0 is ready for release</strong> and will ship -immediately after Axis2/Java 2.0.1, on which it depends. Rampart 2.0.0 +immediately after Axis2/Java 2.0.2, on which it depends. Rampart 2.0.0 brings WS-Security up to date with the Jakarta EE 9+ / Axis2 2.0.x line (<code>jakarta.*</code> namespaces, modern WSS4J, current OpenJDK support) so legacy SOAP services with WS-Security policies can run unchanged on @@ -58,7 +71,7 @@ server/JDK combinations listed below. See the <a href="https://axis.apache.org/axis2/java/rampart/";>Apache Rampart site</a> for details.</p> <p>Apache Axis2, Axis2, Apache, the Apache feather logo, and the Apache Axis2 project logo are trademarks of The Apache Software Foundation.</p> -<h3><em>Why Apache Axis2 in 2026:</em></h3> +<h3><em>Why Apache Axis2 today:</em></h3> <p><strong>One service, three protocols.</strong> Axis2 is the only Java framework that serves JSON-RPC, REST+OpenAPI, and
