Activemq Artemis Apache Activemq Artemis

Do you want an email whenever new security vulnerabilities are reported in Apache Activemq Artemis?

By the Year

In 2022 there have been 3 vulnerabilities in Apache Activemq Artemis with an average score of 6.3 out of ten. Last year Activemq Artemis had 2 security vulnerabilities published. That is, 1 more vulnerability have already been reported in 2022 as compared to last year. Last year, the average CVE base score was greater by 1.20

Year Vulnerabilities Average Score
2022 3 6.30
2021 2 7.50
2020 1 5.50
2019 0 0.00
2018 0 0.00

It may take a day or so for new Activemq Artemis vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apache Activemq Artemis Security Vulnerabilities

A flaw was found in AMQ Broker

CVE-2021-4040 5.3 - Medium - August 24, 2022

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

Memory Corruption

In Apache ActiveMQ Artemis prior to 2.24.0

CVE-2022-35278 6.1 - Medium - August 23, 2022

In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

XSS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1

CVE-2022-23913 7.5 - High - February 04, 2022

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

Resource Exhaustion

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server

CVE-2021-26117 7.5 - High - January 27, 2021

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

authentification

While investigating ARTEMIS-2964 it was found

CVE-2021-26118 7.5 - High - January 27, 2021

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

A flaw was found in ActiveMQ Artemis management API

CVE-2020-10727 5.5 - Medium - June 26, 2020

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

Cleartext Storage of Sensitive Information

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for NetApp Oncommand Workflow Automation or by Apache? Click the Watch button to subscribe.

Apache
Vendor

subscribe