CVE-2018-11775GHSA-M9W8-V359-9FFR
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM a
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.15.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache ActiveMQ
5.0.0 - 5.15.5
- org.apache.activemq:activemq-clientMaven
fixed in 5.15.6
References 15
securitytracker.com
securityfocus.com
lists.apache.org
- thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@<commits.activemq.apache.org>
- thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@<dev.activemq.apache.org>
- thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@<commits.activemq.apache.org>
- thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@<dev.activemq.apache.org>
- thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d@<commits.activemq.apache.org>