logo

Database

Insecure digital certificates In org.apache.activemq:activemq-client

Description

Improper Certificate Validation in Apache activemq-client TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2018-117752. NVD-2018-117753. OSV-2018-117754. OSV-DEBIAN-2018-117755. GHSA-m9w8-v359-9ffr6. GCVE-2018-117757. access.redhat.com8. lists.debian.org9. SECURITY-TRACKER-CVE-2018-11775

References

1. https://github.com/apache/activemq/commit/02971a40e281713a8397d3a1809c164b594abfbb2. https://github.com/apache/activemq/commit/bde7097fb8173cf871827df7811b3865679b963d3. https://issues.apache.org/jira/browse/AMQ-70474. https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@%3Cdev.activemq.apache.org%3E5. https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@%3Ccommits.activemq.apache.org%3E6. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E7. https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@%3Cdev.activemq.apache.org%3E8. https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d@%3Ccommits.activemq.apache.org%3E9. http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.