| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.activemq:activemq-parent | ≥ 5.15.12, < 5.15.13 | 5.15.13 |
| activemq | = 5.15.12 | |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.5.0 | |
| communications element manager | ≥ 8.2.0, ≤ 8.2.4.0 | |
| communications session report manager | ≥ 8.0.0, ≤ 8.2.2 | |
| communications session route manager | ≥ 8.0.0, ≤ 8.2.2 | |
| enterprise repository | = 11.1.1.7.0 | |
| flexcube private banking | = 12.0.0= 12.1.0 |
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free