Description
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | Apache ActiveMQ Artemis – < 2.16.0, Apache ActiveMQ – < 5.16.1 | 2.16.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | activemq | 5.16.1-1 | — |
| Debian 12 | activemq | 5.16.1-1 | — |
| Debian 10 | activemq | 5.15.16-0+deb10u1 | DLA-3657-1 |
| Debian 9 | activemq | 5.14.3-3+deb9u2 | DLA-2583-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | activemq | 5.16.1-1ubuntu0.1~esm1 | USN-6910-1 |
| Ubuntu Pro 20.04 LTS | activemq | 5.15.11-1ubuntu0.1~esm1 | USN-6910-1 |
| Ubuntu Pro 18.04 LTS | activemq | 5.15.8-2~18.04.1~esm1 | USN-6910-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | activemq | 5.13.2+dfsg-2ubuntu0.1~esm1 | USN-6910-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-parent | >= 5.16.0, < 5.16.1 | 5.16.1 | GHSA-9mgm-gcq8-86wq |
| Maven | org.apache.activemq:activemq-parent | < 5.15.14 | 5.15.14 | GHSA-9mgm-gcq8-86wq |
| Maven | org.apache.activemq:apache-artemis | < 2.16.0 | 2.16.0 | GHSA-9mgm-gcq8-86wq |
Advisories 5
- USN-6910-1 activemq vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3657-1 activemq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2583-1 activemq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-2969 Apache ActiveMQ: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 23, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
References
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA%40mail.gmail.com%3e
- [activemq-commits] 20210128 [activemq-website] branch master updated: CVE-2021-26117 - add mitigation section mailing-list
- [announce] 20210128 CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind mailing-list
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947 mailing-list
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update mailing-list
- [activemq-gitbox] 20210323 [GitHub] [activemq-artemis] trevorlinton opened a new pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev commented on pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev closed pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Commented] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210304-0008/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [debian-lts-announce] 20231120 [SECURITY] [DLA 3657-1] activemq security update mailing-list