Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2017-15709GHSA-7QM4-P377-FR2R

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel v

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.3, 5.14.6
None on Exploit-DB, Metasploit or GitHub

Summary

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Apache Software Foundation Apache ActiveMQ

    Apache ActiveMQ 5.14.0 to 5.15.2

  • org.apache.activemq:activemq-openwire-generatorMaven

    From 5.14.0 · fixed in 5.15.3

  • org.apache.activemq:activemq-parentMaven

    From 5.15.0 · fixed in 5.15.3

  • org.apache.activemq:activemq-parentMaven

    From 5.14.0 · fixed in 5.14.6

References 8

lists.apache.org

lists.debian.org