WildFly 41.0.1 is released!

WFCORE-7670 — We have added a significant deny-list to our out-of-the-box JEPS 290 global filter (i.e. the filter set at boot via -Djdk.serialFilter.). The filter setting can be seen in the bin/jdk.serialFilter file. If your application needs to deserialize types denied by this filter you may need to edit the exclusions in bin/jdk.serialFilter. Typical deserialization use cases include handling remote EJB invocations, reading JMS ObjectMessages and serializing and deserializing session content for passivation to disk or a remote Infinispan cluster or for replication using Infinispan.

This release also includes an updated version of Apache CXF which supports blocking decoupled WS-Addressing destinations as a mitigation to reduce the server side request forgery (SSRF) risk. To preserve backwards compatibility, this blocking is disabled by default but it can be enabled by setting the system property org.jboss.ws.cxf.decoupledEndpointEnabled=false.

If the undertow subsystem’s ajp-listener resource is configured, the io.undertow.ajp.AJP_SECRET system property must be set with a value that must match the value of a secret request attribute provided with all AJP requests. Any request that does not provide the expected secret attribute value will be receive an HTTP 403 Forbidden response. If the io.undertow.ajp.AJP_SECRET property is not set, the listener will fail to start. To disable the requirement to configure a secret and use the secret request attribute, set the io.undertow.ajp.REQUIRE_AJP_SECRET system property to false. Note that the AJP listener is deprecated. Users should migrate to HTTP proxying which offers all the same functionality as AJP with proper TLS and mutual authentication support. Provide any feedback in the WildFly google group, Zulip or JIRA.