CVE-2018-11775: Improper Certificate Validation in Apache activemq-client
Summary
CVE-2018-11775: Improper Certificate Validation in Apache activemq-client. Affects org.apache.activemq:activemq-client versions < 5.15.6. Fixed in 5.15.6. How to fix ↓
Also tracked for
- activemq · Debian:11
The same CVE-2018-11775 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache activemq-client is a Java library that provides a client interface for connecting to and interacting with the Apache ActiveMQ message broker. It allows Java applications to send and receive messages using the Java Message Service (JMS) API. The activemq-client library is widely used in enterprise applications for reliable messaging and communication between distributed systems.
Vulnerability Detail
The vulnerability identified as CVE-2018-11775 in the Apache activemq-client library involves improper certificate validation during TLS hostname verification. Prior to version 5.15.6, the client did not perform proper validation of the server's hostname, making it susceptible to a Man-in-the-Middle (MITM) attack. This means that an attacker could intercept and modify the communication between a Java application using the ActiveMQ client and the ActiveMQ server, potentially leading to unauthorized access, data tampering, or other malicious activities. This vulnerability has a CVSS score of 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
5.15.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually enable TLS hostname verification in the Java application code that uses the Apache activemq-client library. This can be achieved by setting the appropriate system property or programmatically configuring the SSLContext to enforce hostname verification. Here is an example of how to enable hostname verification programmatically:
import org.apache.activemq.ActiveMQSslConnectionFactory;
ActiveMQSslConnectionFactory factory = new ActiveMQSslConnectionFactory();
factory.setNeedClientAuth(true);
factory.setVerifyHostName(true);
// Other configuration settings
// ...
Conclusion
The CVE-2018-11775 vulnerability in the Apache activemq-client library exposes Java applications using the library to potential MITM attacks. To mitigate this risk, it is crucial to upgrade to version 5.15.6 or later of the library, which includes the necessary TLS hostname verification. Alternatively, developers can manually enable hostname verification in their code as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
This vulnerability could allow an attacker to intercept and modify the communication between a Java application using the Apache activemq-client library and the ActiveMQ server. This can lead to unauthorized access, data tampering, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your pom.xml file to the playground, and it will analyze your dependencies and alert you if any of them include the vulnerable version of the Apache activemq-client library.
Yes, the fix for this vulnerability is to upgrade to version 5.15.6 or later of the Apache activemq-client library. This version includes the necessary changes to enable TLS hostname verification by default.
Yes, a temporary workaround is to manually enable TLS hostname verification in your Java application code that uses the Apache activemq-client library. Refer to the 'workaround' section above for more details.
You can find more information about this vulnerability in the official CVE-2018-11775 advisory or the GitHub Security Advisory GHSA-m9w8-v359-9ffr.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.