Homepage

CVE-2020-11998 The advisory has been revoked - it doesn't affect any version of package activemq  (opens in a new tab)

Threat Intelligence

EPSS
48.89% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-ACTIVEMQ-674335
  • published11 Sept 2020
  • disclosed10 Sept 2020
Report a new vulnerability Found a mistake?

Introduced: 10 Sep 2020

CVE-2020-11998  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:11.

NVD Description

Note: Versions mentioned in the description apply only to the upstream activemq package and not the activemq package as distributed by Debian.

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

References