Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File

中 6.5CVE-2025-27391 · GHSA-pm4j-p7pm-fpvx · 09/04/2025 公開 · 17/06/2026 更新

要点

CVE-2025-27391 は org.apache.activemq:artemis-project, artemis (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.43%（全脆弱性の 37.7% より高い）。
対処：2.40.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.activemq:artemis-project Maven	`≥ 1.5.1, < 2.40.0`	`2.40.0`
artemis apache	`≥ 1.5.1, < 2.40.0`	`2.40.0`

概要

This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.

Users are recommended to upgrade to version 2.40.0, which fixes the issue.

NVD の説明

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are recommended to upgrade to version 2.40.0, which fixes the issue.