Lack of data validation In org.apache.activemq:activemq-jaas
Description
Improper Input Validation in Apache ActiveMQ The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 5.10.2 | ||
maven | 5.10.2 | ||
maven | 5.10.2 | ||
 debian 13 | 5.6.0+dfsg1-4 | ||
debian 12 | 5.6.0+dfsg1-4 | ||
debian 11 | 5.6.0+dfsg1-4 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5.