Description
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ActiveMQ Artemis | unspecified – < 2.16.0 | 2.16.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | activemq | No fix yet | — |
| Ubuntu Pro 20.04 LTS | activemq | No fix yet | — |
| Ubuntu Pro 18.04 LTS | activemq | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | activemq | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:artemis-openwire-protocol | < 2.16.0 | 2.16.0 | GHSA-q7fr-vqhq-v5xr |
Advisories 1
- WID-SEC-2023-2969 Apache ActiveMQ: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 23, 2024