Description
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | activemq-artemis-operator | < 2.0.3 | 2.0.3 |
| Red Hat | AMQ Broker 7.13.0.OPR.1.GA | — | — |
| Red Hat | Red Hat AMQ Broker 7.12.5 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250529T205903-1.1 | openSUSE-SU-2025:15188-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/arkmq-org/activemq-artemis-operator | <= 0.0.0-20250418141202-b262048e6a75 | — | GHSA-q5q7-8x6x-hcg2 |
| Go | github.com/arkmq-org/activemq-artemis-operator | all versions | — | GO-2025-3717 |
Advisories 2
- openSUSE-SU-2025:15188-1 govulncheck-vulndb-0.0.20250529T205903-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1147 Apache ActiveMQ: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 31, 2025
References
- RHSA-2025:12355 vendor-advisory
- RHSA-2025:12473 vendor-advisory
- RHSA-2025:8147 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-4057 vdb-entry
- RHBZ#2362827 issue-tracking
- https://github.com/arkmq-org/activemq-artemis-operator/commit/d3482fab6d0060794226c9e5a6fa67d209abc35a
- https://github.com/arkmq-org/activemq-artemis-operator/issues/1130