org.apache.activemq:apache-artemis (1.0.0) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.0.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.0.0 Source cves: CVE-2021-26118...

org.apache.activemq:apache-artemis (1.5.5) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.5.5)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.5.5 Source cves: CVE-2021-26118...

org.apache.activemq:apache-artemis (1.5.3) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.5.3)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.5.3 Source cves: CVE-2021-26118...

org.apache.activemq:apache-artemis (1.5.4) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.5.4)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.5.4 Source cves: CVE-2021-26118...

org.apache.activemq:apache-artemis (1.3.0) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.3.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.3.0 Source cves: CVE-2021-26118...

org.apache.activemq:apache-artemis (1.4.0) potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (1.4.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-openwire-protocol and may be impacted: - org.apache.activemq:apache-artemis 1.4.0 Source cves: CVE-2021-26118...

Debian DLA-2583-1 : activemq security update

Multiple security issues were discovered in activemq, a message broker built around Java Message Service. CVE-2017-15709 When using the OpenWire protocol in activemq, it was found that certain system details such as the OS and kernel version are exposed as plain text. CVE-2018-11775 TLS hostname...

CVE-2021-26118

A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity. Mitigation If you are not usin...

7: OpenWire can create destinations with an unpriviledged user

A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity...

UBUNTU-CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

CVE-2021-26118

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

CVE-2021-26118 Flaw in ActiveMQ Artemis OpenWire support

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

com.io7m.jsay:com.io7m.jsay (>=0.0.1, <=0.0.2), io.fabric8.ipaas.apps:artemis (>=2.2.94, <=2.2.96) +10 more potentially affected by CVE-2021-26118 via org.apache.activemq:artemis-openwire-protocol (>=1.0.0, <=2.15.0)

org.apache.activemq:artemis-openwire-protocol MAVEN version =1.0.0, =0.0.1, =2.2.94, =2.2.90, =2.2.97, =2.2.97, =2.2.94, =2.2.90, =2.2.97, =2.2.94, =0.1.0, =0.1.0, =1.0.0, =2.15.0 Source cves: CVE-2021-26118 Source advisory: MEND:CVE-2021-26118...

CVE-2021-26118

The CVE-2021-26118 issue affects Apache ActiveMQ Artemis 2.15.0, where the OpenWire protocol head can produce advisory messages outside policy-based access control for the entire session, bypassing session-wide ACL protection. The root cause is improper access control enforcement during advisory ...

PT-2021-16959

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis version 2.15.0 Description The creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis bypassed policy-based access control for the entire session. This occurred because the production of...

CVE-2021-26118: Improper Access Control

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error...

7: OpenWire can create destinations with an unpriviledged user

A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity...

Apache ActiveMQ 5.14.x - 5.15.2 OpenWire Information Disclosure

The version of Apache ActiveMQ running on the remote host is 5.15.4.x or 5.14.x prior to 5.15.3. It is, therefore, affected by an unspecified flaw related to the OpenWire protocol that allows information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2017-15709

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details such as the OS and kernel version are exposed as plain text...