CVE-2019-0222GHSA-JPV3-G4CC-6VFX
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.15.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Timeline
- CVE published
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Apache Apache ActiveMQ
Apache ActiveMQ 5.0.0 - 5.15.8
- org.apache.activemq:activemq-clientMaven
From 5.0.0 · fixed in 5.15.9
References 20
lists.apache.org
- thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@<commits.activemq.apache.org>
- thread.html/7da9636557118178b1690ba0af49c8a7b7b97d925218b5774622f488@<users.activemq.apache.org>
- thread.html/d1e334bd71d6e68462c62c726fe6db565c7a6283302f9c1feed087fa@<commits.activemq.apache.org>
- thread.html/71640324661c1b6d0b6708bd4fb20170e1b979370a4b8cddc4f8d485@<dev.activemq.apache.org>
- thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@<dev.activemq.apache.org>
- thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@<commits.activemq.apache.org>
- thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@<dev.activemq.apache.org>
- thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d@<commits.activemq.apache.org>
- thread.html/re4672802b0e5ed67c08c9e77057d52138e062f77cc09581b723cf95a@<commits.activemq.apache.org>
- thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@<commits.activemq.apache.org>