CVE-2015-7559: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
Summary
CVE-2015-7559: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ. Affects org.apache.activemq:activemq-client versions < 5.14.5. Fixed in 5.14.5. How to fix ↓
Also tracked for
- activemq · Debian:11
The same CVE-2015-7559 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It is widely used in enterprise systems to facilitate communication between different components. The ActiveMQ client library, specifically the activemq-client package, is responsible for establishing connections and sending/receiving messages. This vulnerability affects versions prior to 5.15.5 of the Apache ActiveMQ client.
Vulnerability Detail
The vulnerability in the Apache ActiveMQ client arises from an exposed remote shutdown command in the ActiveMQConnection class. This command allows an attacker who has logged into a compromised broker to initiate a denial of service attack on a connected client. By exploiting this flaw, an attacker can disrupt the normal functioning of the client, potentially causing service interruptions or other adverse effects.
How To Fix
Minimum fixed version
5.14.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of the Apache ActiveMQ client.
Conclusion
The vulnerability in the Apache ActiveMQ client exposes a remote shutdown command that can be abused by attackers to initiate a denial of service attack on connected clients. To mitigate this risk, it is crucial to upgrade to version 5.15.5 or later of the Apache ActiveMQ client. This will ensure that the exposed command is no longer exploitable. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates reliable messaging between distributed applications.
The vulnerability allows an attacker to initiate a denial of service attack on a connected client, potentially causing service interruptions or other adverse effects.
To fix this vulnerability, it is recommended to upgrade to version 5.15.5 or later of the Apache ActiveMQ client.
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of the Apache ActiveMQ client.
For more information about this vulnerability, you can refer to the CVE-2015-7559 advisory or consult the Apache ActiveMQ documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
