Description
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | 5.0.0 - 5.15.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | activemq | 5.15.6-1 | — |
| Debian 12 | activemq | 5.15.6-1 | — |
| Debian 9 | activemq | 5.14.3-3+deb9u2 | DLA-2583-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | activemq | 5.16.1-1ubuntu0.1~esm1 | USN-6910-1 |
| Ubuntu Pro 20.04 LTS | activemq | 5.15.11-1ubuntu0.1~esm1 | USN-6910-1 |
| Ubuntu Pro 18.04 LTS | activemq | 5.15.8-2~18.04.1~esm1 | USN-6910-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | activemq | 5.13.2+dfsg-2ubuntu0.1~esm1 | USN-6910-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | < 5.15.6 | 5.15.6 | GHSA-m9w8-v359-9ffr |
Advisories 3
- USN-6910-1 activemq vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-2583-1 activemq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2024-0239 Apache ActiveMQ: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 23, 2024
References
- 1041618 vdb-entry
- 105335 vdb-entry
- [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories mailing-list
- [activemq-dev] 20190327 Re: Website mailing-list
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- [activemq-dev] 20190328 Re: Website mailing-list
- RHSA-2019:3892 vendor-advisory
- [activemq-commits] 20200514 [activemq-website] branch master updated: Publish CVE-2020-1941 security advisory mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update mailing-list