Homepage
About Snyk

org.apache.activemq:activemq-core@5.7.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.activemq:activemq-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Authentication

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Improper Authentication. Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the jmxrmi entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.

How to fix Improper Authentication?

There is no fixed version for org.apache.activemq:activemq-core.

[0,)
  • L
Denial of Service (DoS)

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Denial of Service (DoS) in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client.

How to fix Denial of Service (DoS)?

There is no fixed version for org.apache.activemq:activemq-core.

[4.1.1,)
  • H
Man-in-the-Middle (MitM)

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM) due to missing TLS hostname verification.

How to fix Man-in-the-Middle (MitM)?

There is no fixed version for org.apache.activemq:activemq-core.

[5.0.0,)
  • C
Arbitrary Code Execution

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Arbitrary Code Execution. Apache ActiveMQ doesn't restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

How to fix Arbitrary Code Execution?

There is no fixed version for org.apache.activemq:activemq-core.

[5.0.0,)
  • C
XML External Entity (XXE) Injection

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. This could allow remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

How to fix XML External Entity (XXE) Injection?

There is no fixed version for org.apache.activemq:activemq-core.

[0,)
  • H
Improper Authentication

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Improper Authentication. None

How to fix Improper Authentication?

Upgrade org.apache.activemq:activemq-core to version 5.10.1 or higher.

[5.0.0,5.10.1)
  • H
Denial of Service (DoS)

org.apache.activemq:activemq-core is a core package for ActiveMQ Message Broker and Client implementations.

Note: org.apache.activemq:activemq-core is no longer maintained and has been replaced with activemq-client and activemq-broker.

Affected versions of this package are vulnerable to Denial of Service (DoS). The processControlCommand function in broker/TransportConnection.java in ActiveMQ allows remote attackers to cause a denial of service (shutdown) via a shutdown command.

How to fix Denial of Service (DoS)?

There is no fixed version for org.apache.activemq:activemq-core.

[0,)
  • M
Improper Authentication

org.apache.activemq:activemq-core is an open source messaging and Integration Patterns server.

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

[4.1.1,5.8.0)
Go back to all versions of this package