PT-2017-3166 · Apache · Apache Activemq

Publicado 2015-08-07 · Atualizado 2022-05-14 · CVE-2014-3600

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.x through 5.10.0

Description The issue is related to an XML external entity (XXE) vulnerability. It allows remote consumers to have an unspecified impact via vectors involving an XPath-based selector when dequeuing XML messages. The vulnerability can be exploited by a remote attacker to disclose protected information, cause a denial of service, or have other impacts using specially crafted XPath queries.

Recommendations For Apache ActiveMQ versions 5.x through 5.10.0, update to version 5.10.1 or later to resolve the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2017-02578

CVE-2014-3600

DSA-3330-1

GHSA-4VHF-2HV7-8MRX

Produtos afetados

Apache Activemq

Referências · 19

• https://github.com/apache/activemq · Nota
• https://github.com/apache/activemq/commit/3e5ac6326db59f524a0e71f6b717428607d7b67d · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100722 · Nota
• http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3600 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3600 · Aviso do Fabricante
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E · Nota
• http://securityfocus.com/bid/72510 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3600 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4vhf-2hv7-8mrx · Aviso do Fabricante
• https://issues.apache.org/jira/browse/AMQ-5333 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3600 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3600 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3330-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02578 · Nota de Segurança