CVE-2018-11775

Severity

5.9

Description

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11775

http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt

https://tools.cisco.com/security/center/viewAlert.x?alertId=58905&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Apache%20ActiveMQ%20Missing%20TLS%20Hostname%20Verification%20Security%20Bypass%20Vulnerability&vs_k=1&utm_source=dlvr.it&utm_medium=facebook

https://www.securitytracker.com/id/1041618

Project

Apache ActiveMQ

Category

Missing TLS Hostname Verification

Tags

data

Date Disclosed

2018-09-10

Date Discovered

2018-06-05

Apache TomEE 7.1.x

First release:

2018-09-02

CVEs:

81

Support Lifecycle:

Maintenance Support

Namespace:

javax

Apache TomEE 7.0.x

First release:

2016-05-17

CVEs:

111

Support Lifecycle:

Maintenance Support

Namespace:

javax

7.0.0 7.0.1 7.0.2 7.0.3 7.0.4 7.0.5 7.0.6 7.0.7 7.0.8 7.0.9

Apache ActiveMQ 5.15.x

First release:

2017-06-27

CVEs:

25

Support Lifecycle:

Maintenance Support

Namespace:

javax

5.15.0 5.15.1 5.15.2 5.15.3 5.15.4 5.15.5

Apache ActiveMQ 5.14.x

First release:

2016-08-02

CVEs:

24

Support Lifecycle:

Extended Support

Namespace:

javax

5.14.0 5.14.1 5.14.2 5.14.3 5.14.4 5.14.5

Apache ActiveMQ 5.13.x

First release:

2015-11-30

CVEs:

23

Support Lifecycle:

Extended Support

Namespace:

javax

5.13.0 5.13.1 5.13.2 5.13.3 5.13.4 5.13.5

Apache TomEE 1.7.x

First release:

2014-08-09

CVEs:

95

Support Lifecycle:

Namespace:

javax

1.7.0 1.7.1 1.7.2 1.7.3 1.7.4 1.7.5

Apache TomEE 1.6.x

First release:

2013-11-17

CVEs:

108

Support Lifecycle:

Namespace:

javax

1.6.0 1.6.0.1 1.6.0.2

Apache TomEE 1.5.x

First release:

2012-09-28

CVEs:

119

Support Lifecycle:

Namespace:

javax

1.5.0 1.5.1 1.5.2

Apache TomEE 1.0.x

First release:

2012-04-27

CVEs:

130

Support Lifecycle:

Namespace:

javax

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.