PT-2018-5981 · Apache · Apache Activemq

Published 2018-02-13 · Updated 2022-05-13 · CVE-2017-15709

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions 5.14.0 through 5.15.2

Description: The issue allows exposure of certain system details, such as the OS and kernel version, as plain text when using the OpenWire protocol.

Recommendations: For versions 5.14.0 through 5.15.2, consider switching to a different protocol to minimize exposure of system details until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-15709

DLA-2583-1

GHSA-7QM4-P377-FR2R

Affected Products

Apache Activemq

References · 28

• https://cve.org/CVERecord?id=CVE-2017-15709 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-15709 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15709 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15709 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15709 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15709 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2583-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7qm4-p377-fr2r · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15709 · Vendor Advisory
• https://github.com/apache/activemq · Note
• https://github.com/apache/activemq/commit/8ff18c5e254bf43395f2e0d7e3a1092b33ec646 · Note
• https://github.com/apache/activemq/commit/d2e49be3a8f21d862726c1f6bc9e1caa6ee8b58 · Note
• https://lists.apache.org/thread.html/2b6f04a552c6ec2de6563c2df3bba813f0fe9c7e22cce27b7829db89%40%3Cdev.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a9e5f607282010aa196734814@%3Cgitbox.activemq.apache.org%3E · Note