PT-2022-11229 · Unknown · Amq Broker

Viktor Kolomeyko · Published 2022-08-24 · Updated 2022-08-29 · CVE-2021-4040

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions AMQ Broker (affected versions not specified)

Description A flaw in AMQ Broker can cause a partial interruption to its availability via an Out of memory (OOM) condition. This issue allows an attacker to partially disrupt the broker's availability through a sustained attack of maliciously crafted messages. The highest threat from this issue is system availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Resource Exhaustion

Memory Corruption

Weakness Enumeration

CWE-400

CWE-787

Related Identifiers

CVE-2021-4040

GHSA-GF8C-J759-86MG

Affected Products

Amq Broker

References · 14

• https://github.com/apache/activemq-artemis/pull/3871/commits · Patch
• https://issues.apache.org/jira/browse/ARTEMIS-3593 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4040 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2028254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4040 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-4040 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf8c-j759-86mg · Vendor Advisory
• https://github.com/apache/activemq-artemis · Note
• https://github.com/apache/activemq-artemis/pull/3862 · Note
• https://github.com/apache/activemq-artemis/pull/3871/commits/153d2e9a979aead8dff95fbc91d659ecc7d0fb82 · Note
• https://github.com/apache/activemq-artemis/pull/3871 · Note
• https://t.me/cvenotify/35353 · Telegram Post
• https://t.me/cibsecurity/48668 · Telegram Post
• https://t.me/cvenotify/35083 · Telegram Post