Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344718);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id(
    "CVE-2026-49362",
    "CVE-2026-49363",
    "CVE-2026-49364",
    "CVE-2026-57967",
    "CVE-2026-67593",
    "CVE-2026-75880"
  );
  script_xref(name:"IAVA", value:"2026-A-0982");

  script_name(english:"Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Artemis (formerly Apache ActiveMQ Artemis) installed on the remote host is
affected by multiple vulnerabilities:

  - An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an
    existing session and assume ongoing execution of the previously authenticated session.
    (CVE-2026-57967)

  - An unauthenticated network-adjacent attacker can leverage discovery to capture cluster
    administrative credentials during the initial cluster connection handshake. (CVE-2026-49364)

  - A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a
    queue on the Artemis broker before the connection authentication and authorization stage or at any
    time thereafter. (CVE-2026-67593)

Versions 1.0.0 through 2.44.0 (Apache ActiveMQ Artemis) and 2.50.0 through 2.56.x
(Apache Artemis) are affected.

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/3828w4tm5mfpflmoprb5oxfgwhq3xw0v");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/4qbgcz3k38q30bfbf7hphtomrdc8l8n8");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/db34g9qoxd8p08086cr95683fkb8wm5r");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/fxfjqrdsnksw5f17zs3yqo864lblgv6y");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/syjch88zw6pfdoso9vs46m23xkgxjbxo");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/zwqvtndrjtytjsc1hwybk8hjdvcxwyfs");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Artemis version 2.57.0 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-57967");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:activemq_artemis");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_artemis_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Artemis");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache Artemis', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '1.0.0', 'max_version': '2.44.0', 'fixed_display': '2.57.0'},
        {'min_version': '2.50.0', 'fixed_version': '2.57.0'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);