PT-2020-5485 · Apache · Apache Activemq

Published 2020-09-10 · Updated 2024-03-06 · CVE-2020-11998

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.13

Description The issue is related to a regression introduced in a commit that prevents JMX re-bind, allowing a remote client to create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs if there is no security manager. This could enable a rogue remote client to make the Java application execute arbitrary code.

Recommendations Upgrade to Apache ActiveMQ 5.15.13 to resolve the issue. As a temporary workaround, consider restricting access to the RMIConnectorServer to minimize the risk of exploitation. Avoid passing an empty environment map to RMIConnectorServer, and ensure that the map contains the necessary authentication credentials.

Fix

Code Injection

Information Disclosure

Weakness Enumeration

CWE-94

CWE-200

Related Identifiers

BDU:2021-00781

BIT-ACTIVEMQ-2020-11998

CVE-2020-11998

GHSA-WQFH-9M4G-7X6X

Affected Products

Apache Activemq

References · 22

• https://osv.dev/vulnerability/GHSA-wqfh-9m4g-7x6x · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11998 · Security Note
• http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11998 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11998 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/BIT-activemq-2020-11998 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00781 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-11998 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11998 · Vendor Advisory
• https://github.com/apache/activemq/commit/aa8900c · Note
• https://github.com/apache/activemq/commit/0d6e5f2 · Note
• https://github.com/apache/activemq/commit/88b78d0 · Note