A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map     to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ     open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html     A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from     arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make     your Java application execute arbitrary code. Mitigation: Upgrade to Apache ActiveMQ 5.15.13     (CVE-2020-11998)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map
    to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ
    open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html
    "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from
    arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make
    your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
    (CVE-2020-11998)

ID	Name	Product	Family	Type	Severity
250822	Linux Distros Unpatched Vulnerability : CVE-2020-11998	Nessus	Misc.	Local	critical
420071	SCA: security update for org.apache.activemq:activemq-parent (GHSA-wqfh-9m4g-7x6x)	Tenable Cloud Security	SCA Checks	Local	critical
420071	SCA: security update for org.apache.activemq:activemq-parent (GHSA-wqfh-9m4g-7x6x)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2020-11998

critical

Tenable Plugins

critical

critical

critical