You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@artemis.apache.org by ro...@apache.org on 2026/09/09 20:42:51 UTC
(artemis-website) 05/09: update security page for CVE-2026-57967
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/artemis-website.git
commit 068c196d4c595742375c3abb884f194a49baf9d4
Author: Robbie Gemmell <ro...@apache.org>
AuthorDate: Wed Sep 9 19:49:21 2026 +0100
update security page for CVE-2026-57967
---
src/components/artemis/security.md | 2 +-
.../CVE-2026-57967-announcement.txt | 23 ++++++++++++++++++++++
2 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/src/components/artemis/security.md b/src/components/artemis/security.md
index 0da54d44..2ee2450c 100644
--- a/src/components/artemis/security.md
+++ b/src/components/artemis/security.md
@@ -8,7 +8,7 @@ type: artemis
Details of security problems fixed in released versions of Apache Artemis are detailed below.
See the main [Security Advisories](../../security-advisories) page for details for other components and general information such as reporting new security issues.
-
+* [CVE-2026-57967](../../security-advisories.data/CVE-2026-57967-announcement.txt) - Missing authentication on CORE protocol session reattachment
* [CVE-2026-57822](../../security-advisories.data/CVE-2026-57822-announcement.txt) - Message-based management parameter deserialization may lead to denial of service
* [CVE-2026-49364](../../security-advisories.data/CVE-2026-49364-announcement.txt) - Pre-Authentication Cluster Credential Exposure to Discovered Peers
* [CVE-2026-49363](../../security-advisories.data/CVE-2026-49363-announcement.txt) - Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
diff --git a/src/security-advisories.data/CVE-2026-57967-announcement.txt b/src/security-advisories.data/CVE-2026-57967-announcement.txt
new file mode 100644
index 00000000..e5551201
--- /dev/null
+++ b/src/security-advisories.data/CVE-2026-57967-announcement.txt
@@ -0,0 +1,23 @@
+Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
+
+Severity: important
+
+Affected versions:
+- Apache Artemis (org.apache.artemis:artemis-server) 2.50.0 through 2.56.0
+- Apache ActiveMQ Artemis (org.apache.activemq:artemis-server) 1.0.0 through 2.44.0
+
+Description:
+An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.
+
+This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
+
+Users are recommended to upgrade to version 2.57.0, which fixes the issue.
+
+Credit:
+Domenico Francesco Bruscino (finder)
+Fedrick Sequeira (reporter)
+
+References:
+https://artemis.apache.org
+https://www.cve.org/CVERecord?id=CVE-2026-57967
+
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@artemis.apache.org
For additional commands, e-mail: commits-help@artemis.apache.org