You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@activemq.apache.org by ro...@apache.org on 2019/03/27 18:30:47 UTC
[activemq-website] 04/04: add the security advisory txt files to
avoid links breaking,
update security-advisories page with not-so-recent changes
This is an automated email from the ASF dual-hosted git repository.
robbie pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/activemq-website.git
commit f44af6b418771ac5c3745c9bd41e890a1731e09d
Author: Robbie Gemmell <ro...@apache.org>
AuthorDate: Wed Mar 27 17:57:08 2019 +0000
add the security advisory txt files to avoid links breaking, update security-advisories page with not-so-recent changes
---
.../CVE-2014-3576-announcement.txt | 18 +++++++++++++
.../CVE-2014-3579-announcement.txt | 18 +++++++++++++
.../CVE-2014-3600-announcement.txt | 18 +++++++++++++
.../CVE-2014-3612-announcement.txt | 19 +++++++++++++
.../CVE-2014-8110-announcement.txt | 19 +++++++++++++
.../CVE-2015-1830-announcement.txt | 28 +++++++++++++++++++
.../CVE-2015-5254-announcement.txt | 28 +++++++++++++++++++
.../CVE-2015-7559-announcement.txt | 23 ++++++++++++++++
.../CVE-2016-0734-announcement.txt | 19 +++++++++++++
.../CVE-2016-0782-announcement.txt | 19 +++++++++++++
.../CVE-2016-3088-announcement.txt | 26 ++++++++++++++++++
.../CVE-2016-6810-announcement.txt | 19 +++++++++++++
.../CVE-2017-15709-announcement.txt | 21 +++++++++++++++
.../CVE-2018-11775-announcement.txt | 21 +++++++++++++++
.../CVE-2018-8006-announcement.txt | 20 ++++++++++++++
.../CVE-2019-0222-announcement.txt | 22 +++++++++++++++
src/security-advisories.md | 31 ++++++++++++++--------
17 files changed, 358 insertions(+), 11 deletions(-)
diff --git a/src/security-advisories.data/CVE-2014-3576-announcement.txt b/src/security-advisories.data/CVE-2014-3576-announcement.txt
new file mode 100644
index 0000000..1b92094
--- /dev/null
+++ b/src/security-advisories.data/CVE-2014-3576-announcement.txt
@@ -0,0 +1,18 @@
+CVE-2014-3576: Remote Unauthenticated Shutdown of Broker (DoS)
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.10.1
+
+Description:
+It is possible to shutdown an ActiveMQ broker remotely without authentication. The offending network packet is sent to the same port as a message consumer or producer would connect to. If the port is exposed,
+the attack will be possible.
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.11.0
+
+
diff --git a/src/security-advisories.data/CVE-2014-3579-announcement.txt b/src/security-advisories.data/CVE-2014-3579-announcement.txt
new file mode 100644
index 0000000..f302625
--- /dev/null
+++ b/src/security-advisories.data/CVE-2014-3579-announcement.txt
@@ -0,0 +1,18 @@
+CVE-2014-3579: Apache ActiveMQ Apollo XXE with XPath selectors
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ Apollo 1.0 - 1.7
+
+Description:
+It is possible for a consumer dequeuing XML message(s) to specify an XPath based selector thus causing the broker to evaluate the expression and attempt to match it against the messages in the queue while also performing an XML external entity resolution.
+
+Mitigation:
+Upgrade to Apache ActiveMQ Apollo 1.7.1
+
+Credit:
+This issue was discovered by Georgi Geshev from MWR Labs.
\ No newline at end of file
diff --git a/src/security-advisories.data/CVE-2014-3600-announcement.txt b/src/security-advisories.data/CVE-2014-3600-announcement.txt
new file mode 100644
index 0000000..9c46c46
--- /dev/null
+++ b/src/security-advisories.data/CVE-2014-3600-announcement.txt
@@ -0,0 +1,18 @@
+CVE-2014-3600: Apache ActiveMQ XXE with XPath selectors
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.10.0
+
+Description:
+It is possible for a consumer dequeuing XML message(s) to specify an XPath based selector thus causing the broker to evaluate the expression and attempt to match it against the messages in the queue while also performing an XML external entity resolution.
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.10.1 or 5.11.0
+
+Credit:
+This issue was discovered by Georgi Geshev from MWR Labs.
\ No newline at end of file
diff --git a/src/security-advisories.data/CVE-2014-3612-announcement.txt b/src/security-advisories.data/CVE-2014-3612-announcement.txt
new file mode 100644
index 0000000..453d8af
--- /dev/null
+++ b/src/security-advisories.data/CVE-2014-3612-announcement.txt
@@ -0,0 +1,19 @@
+CVE-2014-3612: ActiveMQ JAAS: LDAPLoginModule allows empty password authentication and Wildcard Interpretation
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.10.0
+
+Description:
+It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any v [...]
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.10.1 or 5.11.0
+
+Credit:
+This issue was discovered by Georgi Geshev from MWR Labs and Arun Babu Neelicattu from RedHat.
\ No newline at end of file
diff --git a/src/security-advisories.data/CVE-2014-8110-announcement.txt b/src/security-advisories.data/CVE-2014-8110-announcement.txt
new file mode 100644
index 0000000..c6dbc14
--- /dev/null
+++ b/src/security-advisories.data/CVE-2014-8110-announcement.txt
@@ -0,0 +1,19 @@
+CVE-2014-8110: ActiveMQ Web Console - Cross-Site Scripting
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.10.0
+
+Description:
+Several instances of cross-site scripting vulnerabilities were identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.10.1 or 5.11.0
+
+Credit:
+This issue was discovered by Georgi Geshev from MWR Labs
\ No newline at end of file
diff --git a/src/security-advisories.data/CVE-2015-1830-announcement.txt b/src/security-advisories.data/CVE-2015-1830-announcement.txt
new file mode 100644
index 0000000..f73fc47
--- /dev/null
+++ b/src/security-advisories.data/CVE-2015-1830-announcement.txt
@@ -0,0 +1,28 @@
+CVE-2015-1830 - Path traversal leading to unauthenticated RCE in ActiveMQ
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.11.1
+
+Description:
+
+There is a directory traversal flaw in the fileserver upload/download functionality used for blob messages.
+The attacker can put a jsp file in the admin console and execute shell command from there. It’s only vulnerable in the Windows OS.
+
+Mitigation:
+
+Upgrade to Apache ActiveMQ 5.12.0 or 5.11.2. The workaround in case fileserver is not used and upgrade is not prefereable is to disable that functionality. It can be done by removing (commenting out) the following lines from conf\jetty.xml file
+
+<bean class="org.eclipse.jetty.webapp.WebAppContext">
+ <property name="contextPath" value="/fileserver" />
+ <property name="resourceBase" value="${activemq.home}/webapps/fileserver" />
+ <property name="logUrlOnStart" value="true" />
+ <property name="parentLoaderPriority" value="true" />
+</bean>
+
+Credit:
+This issue was discovered by separated reports of David Jorm from IIX Product Security and Steven Seeley from Source Incite working with HP's Zero Day Initiative (ZDI)
diff --git a/src/security-advisories.data/CVE-2015-5254-announcement.txt b/src/security-advisories.data/CVE-2015-5254-announcement.txt
new file mode 100644
index 0000000..02e4806
--- /dev/null
+++ b/src/security-advisories.data/CVE-2015-5254-announcement.txt
@@ -0,0 +1,28 @@
+CVE-2015-5254 - Unsafe deserialization in ActiveMQ
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.12.1
+
+Description:
+
+JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they d [...]
+
+Mitigation:
+
+Upgrade to Apache ActiveMQ 5.13.0. Additionally if you're using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at: http://activemq.apache.org/objectmessage.html
+
+
+
+Credit:
+This issue was discovered by:
+
+* Alvaro Muñoz - @pwntester
+* Matthias Kaiser - @matthias_kaiser
+* Christian Schneider - @cschneider4711
+
+Special thanks to Matthias Kaiser for providing the detailed analysis of the vunerability.
diff --git a/src/security-advisories.data/CVE-2015-7559-announcement.txt b/src/security-advisories.data/CVE-2015-7559-announcement.txt
new file mode 100644
index 0000000..c4aecf0
--- /dev/null
+++ b/src/security-advisories.data/CVE-2015-7559-announcement.txt
@@ -0,0 +1,23 @@
+CVE-2015-7559 - DoS in client via shutdown command
+
+Severity: Low
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.14.4
+
+Description:
+
+It was found that Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client.
+
+Mitigation:
+
+Upgrade to Apache ActiveMQ 5.14.5.
+
+
+
+Credit:
+
+Thanks to Chess Hazlett for reporting this vulnerability
diff --git a/src/security-advisories.data/CVE-2016-0734-announcement.txt b/src/security-advisories.data/CVE-2016-0734-announcement.txt
new file mode 100644
index 0000000..a7be1e9
--- /dev/null
+++ b/src/security-advisories.data/CVE-2016-0734-announcement.txt
@@ -0,0 +1,19 @@
+CVE-2016-0734: ActiveMQ Web Console - Clickjacking
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.13.1
+
+Description:
+The web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.13.2
+
+Credit:
+This issue was discovered by Michael Furman
diff --git a/src/security-advisories.data/CVE-2016-0782-announcement.txt b/src/security-advisories.data/CVE-2016-0782-announcement.txt
new file mode 100644
index 0000000..63ce81d
--- /dev/null
+++ b/src/security-advisories.data/CVE-2016-0782-announcement.txt
@@ -0,0 +1,19 @@
+CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.13.0
+
+Description:
+Several instances of cross-site scripting vulnerabilities were identified to be present in the web based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are improper user data output validation and incorrect permissions configured on Jolokia.
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.11.4, 5.12.3, or 5.13.1
+
+Credit:
+This issue was discovered by Vladimir Ivanov (Positive Technologies)
diff --git a/src/security-advisories.data/CVE-2016-3088-announcement.txt b/src/security-advisories.data/CVE-2016-3088-announcement.txt
new file mode 100644
index 0000000..13aa59a
--- /dev/null
+++ b/src/security-advisories.data/CVE-2016-3088-announcement.txt
@@ -0,0 +1,26 @@
+CVE-2016-3088 - ActiveMQ Fileserver web application vulnerabilities
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.13.x
+
+Description:
+
+Multiple vulnerabilities have been identified in the Apache ActiveMQ Fileserver web application. These are similar to those reported in CVE-2015-1830 and can allow attackers to replace web application files with malicious code and perform remote code execution on the system.
+
+Mitigation:
+
+Fileserver feature will be completely removed starting with 5.14.0 release. Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0). This can be done by removing (commenting out) the following lines from conf\jetty.xml file
+
+<bean class="org.eclipse.jetty.webapp.WebAppContext">
+ <property name="contextPath" value="/fileserver" />
+ <property name="resourceBase" value="${activemq.home}/webapps/fileserver" />
+ <property name="logUrlOnStart" value="true" />
+ <property name="parentLoaderPriority" value="true" />
+</bean>
+
+Credit:
+This issue was discovered by separated reports of Simon Zuckerbraun and Andrea Micalizzi (rgod) of Trend Micro Zero Day Initiative
\ No newline at end of file
diff --git a/src/security-advisories.data/CVE-2016-6810-announcement.txt b/src/security-advisories.data/CVE-2016-6810-announcement.txt
new file mode 100644
index 0000000..27fe482
--- /dev/null
+++ b/src/security-advisories.data/CVE-2016-6810-announcement.txt
@@ -0,0 +1,19 @@
+CVE-2016-6810: ActiveMQ Web Console - Cross-Site Scripting
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.14.1
+
+Description:
+An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.14.2
+
+Credit:
+This issue was discovered by Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. and was reported by JPCERT/CC.
diff --git a/src/security-advisories.data/CVE-2017-15709-announcement.txt b/src/security-advisories.data/CVE-2017-15709-announcement.txt
new file mode 100644
index 0000000..5631668
--- /dev/null
+++ b/src/security-advisories.data/CVE-2017-15709-announcement.txt
@@ -0,0 +1,21 @@
+
+CVE-2017-15709 - Information Leak
+
+Severity: Low
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.14.0 - 5.15.2
+
+Description:
+
+When using the OpenWire protocol it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
+
+Mitigation:
+
+Use a TLS enabled transport or upgrade to Apache ActiveMQ 5.15.3.
+
+Credit:
+This issue was discovered by QingTeng cloud Security of Minded Security Researcher jianan.huang
diff --git a/src/security-advisories.data/CVE-2018-11775-announcement.txt b/src/security-advisories.data/CVE-2018-11775-announcement.txt
new file mode 100644
index 0000000..7c7a093
--- /dev/null
+++ b/src/security-advisories.data/CVE-2018-11775-announcement.txt
@@ -0,0 +1,21 @@
+
+CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.15.5
+
+Description:
+
+TLS hostname verification when using the Apache ActiveMQ Client was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
+
+Mitigation:
+
+Upgrade to Apache ActiveMQ 5.15.6
+
+Credit:
+This issue was discovered by Peter Stöckli (Alphabot Security)
diff --git a/src/security-advisories.data/CVE-2018-8006-announcement.txt b/src/security-advisories.data/CVE-2018-8006-announcement.txt
new file mode 100644
index 0000000..bf4fe99
--- /dev/null
+++ b/src/security-advisories.data/CVE-2018-8006-announcement.txt
@@ -0,0 +1,20 @@
+
+CVE-2018-8006: ActiveMQ Web Console - Cross-Site Scripting
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.15.5
+
+Description:
+An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter.
+
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.15.6 or disable the Web Console
+
+Credit:
+This issue was discovered by Robert Foggia of SpiderLabs
diff --git a/src/security-advisories.data/CVE-2019-0222-announcement.txt b/src/security-advisories.data/CVE-2019-0222-announcement.txt
new file mode 100644
index 0000000..61e41c5
--- /dev/null
+++ b/src/security-advisories.data/CVE-2019-0222-announcement.txt
@@ -0,0 +1,22 @@
+CVE-2019-0222 - Corrupt MQTT frame can cause broker shutdown
+
+Severity: Important
+
+Vendor:
+The Apache Software Foundation
+
+Versions Affected:
+Apache ActiveMQ 5.0.0 - 5.15.8
+
+Description:
+Unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
+
+Mitigation:
+Upgrade to Apache ActiveMQ 5.15.9. Alternatevly, you can manually upgrade MQTT library to version 1.15 in lib/extra directory. You can download the jar from https://repo1.maven.org/maven2/org/fusesource/mqtt-client/mqtt-client/1.15/mqtt-client-1.15.jar. If you don't use MQTT protocol, you can disable the transport as well.
+
+
+Credit:
+This issue was discovered by:
+
+* Indrajeet Singh - <in...@ymail.com>
+
diff --git a/src/security-advisories.md b/src/security-advisories.md
index 3681c5e..67b1dd6 100644
--- a/src/security-advisories.md
+++ b/src/security-advisories.md
@@ -11,24 +11,33 @@ type: activemq5
Apache ActiveMQ
---------------
+
+#### 2019
+* [CVE-2019-0222](security-advisories.data/CVE-2019-0222-announcement.txt) - Corrupt MQTT frame can cause broker shutdown
+
+#### 2018
+* [CVE-2018-8006](security-advisories.data/CVE-2018-8006-announcement.txt) - ActiveMQ Web Console - Cross-Site Scripting
+* [CVE-2017-15709](security-advisories.data/CVE-2017-15709-announcement.txt) - Information Leak
+* [CVE-2018-11775](security-advisories.data/CVE-2018-11775-announcement.txt) - Missing TLS Hostname Verification
+
#### 2017
-* [CVE-2015-7559](security-advisories.data/CVE-2015-7559-announcement.txt?version=1&modificationDate=1493024710000&api=v2) - DoS in client via shutdown command
+* [CVE-2015-7559](security-advisories.data/CVE-2015-7559-announcement.txt) - DoS in client via shutdown command
#### 2016
-* [CVE-2016-6810](security-advisories.data/CVE-2016-6810-announcement.txt?version=2&modificationDate=1481290006000&api=v2) - ActiveMQ Web Console - Cross-Site Scripting
-* [CVE-2016-0734](security-advisories.data/CVE-2016-0734-announcement.txt?version=1&modificationDate=1457613666000&api=v2) - ActiveMQ Web Console - Clickjacking
-* [CVE-2016-0782](security-advisories.data/CVE-2016-0782-announcement.txt?version=2&modificationDate=1458229308000&api=v2) - ActiveMQ Web Console - Cross-Site Scripting
-* [CVE-2016-3088](security-advisories.data/CVE-2016-3088-announcement.txt?version=5&modificationDate=1464092715000&api=v2) - ActiveMQ Fileserver web application vulnerabilities
+* [CVE-2016-6810](security-advisories.data/CVE-2016-6810-announcement.txt) - ActiveMQ Web Console - Cross-Site Scripting
+* [CVE-2016-0734](security-advisories.data/CVE-2016-0734-announcement.txt) - ActiveMQ Web Console - Clickjacking
+* [CVE-2016-0782](security-advisories.data/CVE-2016-0782-announcement.txt) - ActiveMQ Web Console - Cross-Site Scripting
+* [CVE-2016-3088](security-advisories.data/CVE-2016-3088-announcement.txt) - ActiveMQ Fileserver web application vulnerabilities
#### 2015
-* [CVE-2015-5254](security-advisories.data/CVE-2015-5254-announcement.txt?version=1&modificationDate=1449589734000&api=v2) - Unsafe deserialization in ActiveMQ
-* [CVE-2015-1830](security-advisories.data/CVE-2015-1830-announcement.txt?version=2&modificationDate=1440426986000&api=v2) - Path traversal leading to unauthenticated RCE in ActiveMQ
+* [CVE-2015-5254](security-advisories.data/CVE-2015-5254-announcement.txt) - Unsafe deserialization in ActiveMQ
+* [CVE-2015-1830](security-advisories.data/CVE-2015-1830-announcement.txt) - Path traversal leading to unauthenticated RCE in ActiveMQ
#### 2014
-* [CVE-2014-3576](security-advisories.data/CVE-2014-3576-announcement.txt?version=1&modificationDate=1446901063000&api=v2) - Remote Unauthenticated Shutdown of Broker (DoS)
-* [CVE-2014-3600](security-advisories.data/CVE-2014-3600-announcement.txt?version=2&modificationDate=1423051306000&api=v2) - Apache ActiveMQ XXE with XPath selectors
-* [CVE-2014-3612](security-advisories.data/CVE-2014-3612-announcement.txt?version=2&modificationDate=1423051365000&api=v2) - ActiveMQ JAAS: LDAPLoginModule allows empty password authentication and Wildcard Interpretation
-* [CVE-2014-8110](security-advisories.data/CVE-2014-8110-announcement.txt?version=2&modificationDate=1423051381000&api=v2) - ActiveMQ Web Console - Cross-Site Scripting
+* [CVE-2014-3576](security-advisories.data/CVE-2014-3576-announcement.txt) - Remote Unauthenticated Shutdown of Broker (DoS)
+* [CVE-2014-3600](security-advisories.data/CVE-2014-3600-announcement.txt) - Apache ActiveMQ XXE with XPath selectors
+* [CVE-2014-3612](security-advisories.data/CVE-2014-3612-announcement.txt) - ActiveMQ JAAS: LDAPLoginModule allows empty password authentication and Wildcard Interpretation
+* [CVE-2014-8110](security-advisories.data/CVE-2014-8110-announcement.txt) - ActiveMQ Web Console - Cross-Site Scripting
ActiveMQ Apollo