You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@activemq.apache.org by gt...@apache.org on 2021/01/27 17:04:58 UTC
[activemq-website] branch master updated: Publish CVE-2021-26117
This is an automated email from the ASF dual-hosted git repository.
gtully pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/activemq-website.git
The following commit(s) were added to refs/heads/master by this push:
new b66a9ff Publish CVE-2021-26117
b66a9ff is described below
commit b66a9ff9541dcc4d3019697afdd9ad3aae278cc2
Author: gtully <ga...@gmail.com>
AuthorDate: Wed Jan 27 17:04:38 2021 +0000
Publish CVE-2021-26117
---
src/components/artemis/security.md | 3 ++-
src/components/classic/security.md | 1 +
.../CVE-2021-26117-announcement.txt | 17 +++++++++++++++++
3 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/src/components/artemis/security.md b/src/components/artemis/security.md
index dfeebdd..468d52a 100644
--- a/src/components/artemis/security.md
+++ b/src/components/artemis/security.md
@@ -9,7 +9,8 @@ Details of security problems fixed in released versions of Apache ActiveMQ Artem
See the main [Security Advisories](../../security-advisories) page for details for other components and general information such as reporting new security issues.
-* [CVE-2021-26118](../../security-advisories.data/CVE-2021-26118-announcement.txt) - Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin
+* [CVE-2021-26117](../../security-advisories.data/CVE-2021-26117-announcement.txt) - ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
+* [CVE-2021-26118](../../security-advisories.data/CVE-2021-26118-announcement.txt) - Flaw in ActiveMQ Artemis OpenWire support
* [CVE-2020-13932](../../security-advisories.data/CVE-2020-13932-announcement.txt) - Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin
* [CVE-2017-12174](../../security-advisories.data/CVE-2017-12174-announcement.txt) - Memory exhaustion via UDP and JGroups discovery
* [CVE-2016-4978](../../security-advisories.data/CVE-2016-4978-announcement.txt) - Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability
diff --git a/src/components/classic/security.md b/src/components/classic/security.md
index b3b7459..fafe3a4 100644
--- a/src/components/classic/security.md
+++ b/src/components/classic/security.md
@@ -9,6 +9,7 @@ Details of security problems fixed in released versions of Apache ActiveMQ 5.x a
See the main [Security Advisories](../../security-advisories) page for details for other components and general information such as reporting new security issues.
+* [CVE-2021-26117](../../security-advisories.data/CVE-2021-26117-announcement.txt) - ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
* [CVE-2020-11998](../../security-advisories.data/CVE-2020-11998-announcement.txt) - JMX remote client could execute arbitrary code
* [CVE-2020-13920](../../security-advisories.data/CVE-2020-13920-announcement.txt) - JMX MITM vulnerability
* [CVE-2020-1941](../../security-advisories.data/CVE-2020-1941-announcement.txt) - XSS in WebConsole
diff --git a/src/security-advisories.data/CVE-2021-26117-announcement.txt b/src/security-advisories.data/CVE-2021-26117-announcement.txt
new file mode 100644
index 0000000..1e4e7ae
--- /dev/null
+++ b/src/security-advisories.data/CVE-2021-26117-announcement.txt
@@ -0,0 +1,17 @@
+ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind (CVE-2021-26117)
+PRODUCT AFFECTED:
+This issue affects Apache ActiveMQ Apache ActiveMQ, Apache ActiveMQ Artemis.
+
+PROBLEM:
+The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
+
+This issue has been assigned CVE-2021-26117.
+
+This issue is being tracked as https://issues.apache.org/jira/browse/ARTEMIS-2895 and https://issues.apache.org/jira/browse/AMQ-8035.
+
+MODIFICATION HISTORY:
+: Initial Publication.
+RELATED LINKS:
+CVE-2021-26117 at cve.mitre.org
+ACKNOWLEDGEMENTS:
+Apache ActiveMQ would like to thank Gregor Tudan <gr...@cofinpro.de> for reporting this issue.