Homepage

org.apache.activemq:activemq-amqp@5.13.1

  • latest version

    6.3.2

  • latest non vulnerable version

    6.3.2

  • first published

    13 years ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.activemq:activemq-amqp package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Authorization

    org.apache.activemq:activemq-amqp is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

    Affected versions of this package are vulnerable to Improper Authorization in AuthorizationBroker through the temporary-destination write ACL check in AuthorizationBroker.java. An authenticated low-privilege user can publish messages to destinations they are not allowed to write by sending to a temporary composite destination whose physical name is a comma-separated list of real queues. Because the broker treats the composite temporary destination as a temporary destination for ACL evaluation, the per-destination write check is bypassed and messages reach the listed queues without the required write permissions.

    How to fix Improper Authorization?

    Upgrade org.apache.activemq:activemq-amqp to version 5.19.9, 6.2.8 or higher.

    [,5.19.9)[6.0.0,6.2.8)
    • H
    Improper Validation of Specified Quantity in Input

    org.apache.activemq:activemq-amqp is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

    Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in AmqpFrameParser and AmqpWireFormat in the AMQP NIO transport. An attacker can cause a denial of service by sending a malformed AMQP frame with a negative or otherwise invalid frame size value. The parser accepts the attacker-supplied size before allocating and reading the frame, and a remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger NIO thread failures by repeatedly sending such frames. If done rapidly enough, the NIO thread pool is exhausted and other connections lose service.

    How to fix Improper Validation of Specified Quantity in Input?

    Upgrade org.apache.activemq:activemq-amqp to version 5.19.9, 6.2.8 or higher.

    [,5.19.9)[6.0.0,6.2.8)
    Go back to all versions of this package