CVE-2017-15709 ActiveMQ's OpenWire protocol exposes certain system details as plain text
LowCVSS 3.7
EPSS 22.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-openwire-generator(Maven) | >= 5.14.0, < 5.15.3 | 5.15.3 |
| org.apache.activemq/activemq-parent(Maven) | >= 5.15.0, < 5.15.3 | 5.15.3 |
| org.apache.activemq/activemq-parent(Maven) | >= 5.14.0, < 5.14.6 | 5.14.6 |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.0 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.1 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.2 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.3 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.4 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.14.5 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.15.0 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.15.1 | No fix listed |
| org.apache.activemq/activemq-openwire-generator(Maven) | = 5.15.2 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.15.0 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.15.1 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.15.2 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.0 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.1 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.2 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.3 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.4 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.14.5 | No fix listed |
| debian/activemq(Debian:12) | < 5.15.3-1 | 5.15.3-1 |
| debian/activemq(Debian:13) | < 5.15.3-1 | 5.15.3-1 |
| apache activemq | >= 5.14.0, <= 5.15.2 | No fix listed |
| Apache ActiveMQ | = Apache ActiveMQ 5.14.0 to 5.15.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update mailing-list
- github.com patch
- github.com patch
- issues.apache.org
- github.com
- github.com product
- Debian Security Tracker CVE-2017-15709 vendor-advisory
- [activemq-dev] 20190328 Re: Website mailing-list
- [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories mailing-list
- lists.apache.org
- [activemq-gitbox] 20191021 [GitHub] [activemq-website] clebertsuconic commented on a change in pull request #17: Fix the ordering in the security advisories page mailing-list
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list
- [activemq-gitbox] 20191022 [GitHub] [activemq-website] coheigea commented on a change in pull request #17: Fix the ordering in the security advisories page mailing-list
- [activemq-dev] 20190327 Re: Website mailing-list
- bugs.debian.org issue-tracking