| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.apache.activemq:activemq-parent | ≥ 5.15.12, < 5.15.13 | 5.15.13 |
| activemq | = 5.15.12 | |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.5.0 | |
| communications element manager | ≥ 8.2.0, ≤ 8.2.4.0 | |
| communications session report manager | ≥ 8.0.0, ≤ 8.2.2 | |
| communications session route manager | ≥ 8.0.0, ≤ 8.2.2 | |
| enterprise repository | = 11.1.1.7.0 | |
| flexcube private banking | = 12.0.0= 12.1.0 |
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí