activemq - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2019-0222 Public exploit EPSS 12%

  Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client

  In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

  Apache Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  Mar 28, 2019
• High 7.5
  CVE-2021-26117 EPSS 12%

  ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

  The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to …

  Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  Jan 27, 2021
• High 7.4
  CVE-2018-11775

  Improper Certificate Validation in Apache activemq-client

  TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

  Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  Sep 10, 2018
• Low 3.7
  CVE-2017-15709 EPSS 23%

  ActiveMQ's OpenWire protocol exposes certain system details as plain text

  When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

  Apache Software Foundation Apache ActiveMQ activemq org.apache.activemq:activemq-parent Debian Maven
  Feb 13, 2018