When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system
    details (such as the OS and kernel version) are exposed as plain text. (CVE-2017-15709)

Multiple security issues were discovered in activemq, a message broker built around Java Message Service.

CVE-2017-15709

When using the OpenWire protocol in activemq, it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

CVE-2018-11775

TLS hostname verification when using the Apache ActiveMQ Client was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

CVE-2019-0222

Unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive

CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. The anonymous context is used to verify a valid users password in error, resulting in no check on the password.

For Debian 9 stretch, these problems have been fixed in version 5.14.3-3+deb9u2.

We recommend that you upgrade your activemq packages.

For the detailed security status of activemq please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/activemq

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache ActiveMQ running on the remote host is 5.15.4.x or 5.14.x prior to 5.15.3. It is, therefore, affected by an unspecified flaw related to the OpenWire protocol that allows information disclosure.

ID	Name	Product	Family	Severity
412207	SCA: security update for org.apache.activemq:activemq-openwire-generator, org.apache.activemq:activemq-parent (GHSA-7qm4-p377-fr2r)	Tenable Cloud Security	SCA Checks	low
412207	SCA: security update for org.apache.activemq:activemq-openwire-generator, org.apache.activemq:activemq-parent (GHSA-7qm4-p377-fr2r)	Tenable Self-Hosted Container Security	SCA Checks	low
147182	Debian DLA-2583-1 : activemq security update	Nessus	Debian Local Security Checks	high
117482	Apache ActiveMQ 5.14.x - 5.15.2 OpenWire Information Disclosure	Nessus	CGI abuses	low

Detections

Analytics

CVE-2017-15709

low

Tenable Plugins

low

low

high

low