CVE-2022-23913: Uncontrolled Resource Consumption in Apache ActiveMQ Artemis
Summary
CVE-2022-23913: Apache ActiveMQ Artemis Uncontrolled Resource Consumption (DoS). Affects org.apache.activemq:artemis-core-client versions < 2.19.1. Fixed in 2.19.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ Artemis is an open-source messaging broker that implements the Java Message Service (JMS) API. It provides a high-performance, multi-protocol messaging system for building distributed applications. The 'org.apache.activemq:artemis-commons' package is a part of Apache ActiveMQ Artemis and contains common utility classes used by the messaging broker. This package is vulnerable to uncontrolled resource consumption, which can lead to a partial disruption of availability (DoS) due to excessive memory usage.
Vulnerability Detail
The vulnerability in Apache ActiveMQ Artemis allows an attacker to exploit uncontrolled resource consumption, resulting in a denial-of-service (DoS) condition. By sending specially crafted requests, an attacker can cause the messaging broker to consume excessive memory, leading to performance degradation or even system failure. This vulnerability can be exploited remotely without authentication, making it a significant security concern for systems using Apache ActiveMQ Artemis.
How To Fix
Minimum fixed version
2.19.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Apache ActiveMQ Artemis.
Conclusion
The uncontrolled resource consumption vulnerability in Apache ActiveMQ Artemis can lead to a denial-of-service (DoS) condition by causing excessive memory usage. It is crucial to upgrade to the latest version of Apache ActiveMQ Artemis (2.19.1 or later) to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:artemis-core-client →
FAQ
Apache ActiveMQ Artemis is an open-source messaging broker that implements the Java Message Service (JMS) API. It provides a high-performance, multi-protocol messaging system for building distributed applications.
This vulnerability allows an attacker to cause uncontrolled resource consumption, leading to a denial-of-service (DoS) condition. It can result in performance degradation or system failure.
Yes, this vulnerability can be exploited remotely without authentication, making it a significant security concern for systems using Apache ActiveMQ Artemis.
Yes, upgrading to Apache ActiveMQ Artemis version 2.19.1 or later includes a fix for this vulnerability. It is recommended to update the package in your Maven project and rebuild your application.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of Apache ActiveMQ Artemis.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:artemis-core-client.
