PT-2017-3166 · Apache · Apache Activemq

Published 2015-08-07 · Updated 2022-05-14 · CVE-2014-3600

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.x through 5.10.0

Description The issue is related to an XML external entity (XXE) vulnerability. It allows remote consumers to have an unspecified impact via vectors involving an XPath-based selector when dequeuing XML messages. The vulnerability can be exploited by a remote attacker to disclose protected information, cause a denial of service, or have other impacts using specially crafted XPath queries.

Recommendations For Apache ActiveMQ versions 5.x through 5.10.0, update to version 5.10.1 or later to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2017-02578

CVE-2014-3600

DSA-3330-1

GHSA-4VHF-2HV7-8MRX

Affected Products

Apache Activemq

References · 19

• http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3600 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3600 · Security Note
• https://osv.dev/vulnerability/GHSA-4vhf-2hv7-8mrx · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3600 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3600 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3330-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02578 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-3600 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-3600 · Vendor Advisory
• https://github.com/apache/activemq · Note
• https://github.com/apache/activemq/commit/3e5ac6326db59f524a0e71f6b717428607d7b67d · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100722 · Note
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E · Note