CVE-2015-7559 Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
LowCVSS 2.7
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-client(Maven) | < 5.14.5 | 5.14.5 |
| org.apache.activemq/activemq-client(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.10.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.10.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.4 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.4 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.5 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.14.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.14.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.14.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.14.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.14.4 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.8.0 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-client(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.9.1 | No fix listed |
| debian/activemq(Debian:12) | < 5.14.3-3 | 5.14.3-3 |
| debian/activemq(Debian:13) | < 5.14.3-3 | 5.14.3-3 |
| apache activemq | < 5.14.5 | 5.14.5 |
| apache activemq | >= 5.15.0, < 5.15.5 | 5.15.5 |
| redhat jboss a-mq | = 6.2.1 | No fix listed |
| redhat jboss a-mq | = 6.3 | No fix listed |
| redhat jboss fuse | = 6.3 | No fix listed |
| apache activemq | = 5.15.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- issues.apache.org patch vendor-advisory
- github.com patch
- github.com
- github.com product
- Debian Security Tracker CVE-2015-7559 vendor-advisory
- bugs.debian.org issue-tracking