[MAVEN:GHSA-23CR-5HR4-RGWV] Improper Input Validation in Apache ActiveMQ

Severity Moderate

Affected Packages 2

Fixed Packages 2

CVEs 1

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.

Package	Affected Version
pkg:maven/org.apache.activemq/activemq-jaas	>= 5.0.0, <= 5.10.1
pkg:maven/org.apache.activemq/activemq-broker	>= 5.0.0, <= 5.10.1

Package	Fixed Version
pkg:maven/org.apache.activemq/activemq-jaas	= 5.10.2
pkg:maven/org.apache.activemq/activemq-broker	= 5.10.2

ID

MAVEN:GHSA-23CR-5HR4-RGWV

Severity

moderate

URL

https://github.com/advisories/GHSA-23cr-5hr4-rgwv

Published

2022-05-17T03:22:06
(2 years ago)

Modified

2023-12-20T19:16:01
(9 months ago)

Rights

Maven Security Team

Other Advisories

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2015-6524
			http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt
			http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.html
			http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.html
			https://github.com/apache/activemq/commit/22f2f3dde757d31307da772d579815c1d169bc39
			https://github.com/advisories/GHSA-23cr-5hr4-rgwv

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.apache.activemq/activemq-jaas	org.apache.activemq	activemq-jaas	>= 5.0.0 <= 5.10.1
Fixed	pkg:maven/org.apache.activemq/activemq-jaas	org.apache.activemq	activemq-jaas	= 5.10.2
Affected	pkg:maven/org.apache.activemq/activemq-broker	org.apache.activemq	activemq-broker	>= 5.0.0 <= 5.10.1
Fixed	pkg:maven/org.apache.activemq/activemq-broker	org.apache.activemq	activemq-broker	= 5.10.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date