Description
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | Apache ActiveMQ 5.14.0 to 5.15.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | activemq | 5.15.3-1 | — |
| Debian 12 | activemq | 5.15.3-1 | — |
| Debian 9 | activemq | 5.14.3-3+deb9u2 | DLA-2583-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-openwire-generator | >= 5.14.0, < 5.15.3 | 5.15.3 | GHSA-7qm4-p377-fr2r |
| Maven | org.apache.activemq:activemq-parent | >= 5.15.0, < 5.15.3 | 5.15.3 | GHSA-7qm4-p377-fr2r |
| Maven | org.apache.activemq:activemq-parent | >= 5.14.0, < 5.14.6 | 5.14.6 | GHSA-7qm4-p377-fr2r |
Advisories 1
- DLA-2583-1 activemq - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://lists.apache.org/thread.html/2b6f04a552c6ec2de6563c2df3bba813f0fe9c7e22cce27b7829db89%40%3Cdev.activemq.apache.org%3E
- [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories mailing-list
- [activemq-dev] 20190327 Re: Website mailing-list
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- [activemq-dev] 20190328 Re: Website mailing-list
- [activemq-gitbox] 20191021 [GitHub] [activemq-website] clebertsuconic commented on a change in pull request #17: Fix the ordering in the security advisories page mailing-list
- [activemq-gitbox] 20191022 [GitHub] [activemq-website] coheigea commented on a change in pull request #17: Fix the ordering in the security advisories page mailing-list
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update mailing-list