activemq - security update

Fixed packages 1

Vulnerabilities 3

• Critical 10.0
  CVE-2023-46604 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

  The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Legacy OpenWire Module activemq Debian Ubuntu Maven
  Oct 27, 2023

  KEV Nov 2, 2023
• High 7.5
  CVE-2021-26117 EPSS 12%

  ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

  The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to …

  Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  Jan 27, 2021
• Medium 5.9
  CVE-2020-13920

  Improper Authentication in Apache ActiveMQ

  Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If …

  activemq activemq org.apache.activemq:activemq-parent Debian Ubuntu Maven
  Sep 10, 2020