TLS hostname verification missing in Apache ActiveMQ Client
Summary
CVE-2018-11775: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ serv... Affects activemq across 2 version ranges.
< 5.15.6-1
< cf6aa9427ab6f8aa68a9c62652acd103151ce5eb
Fixed in 5.15.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It is widely used in enterprise systems to facilitate communication between different components. The Apache ActiveMQ Client is a Java library that allows applications to interact with an ActiveMQ message broker. However, prior to version 5.15.6, the client was missing TLS hostname verification, making it vulnerable to a man-in-the-middle (MITM) attack. This means that an attacker could intercept and modify the communication between a Java application using the ActiveMQ client and the ActiveMQ server.
Vulnerability Detail
The missing TLS hostname verification in the Apache ActiveMQ Client exposes the communication channel to potential attackers. Without proper verification, an attacker can impersonate the server and intercept or modify the messages exchanged between the client and the server. This can lead to various security risks, including unauthorized access, data leakage, and tampering of critical information. The vulnerability has a CVSS score of 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
5.15.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually enable TLS hostname verification in the ActiveMQ client configuration. This can be done by setting the 'verifyHostName' property to 'true' in the client's SSLContext. Here is an example code snippet for enabling TLS hostname verification:
import org.apache.activemq.ActiveMQSslConnectionFactory;
ActiveMQSslConnectionFactory factory = new ActiveMQSslConnectionFactory();
factory.setVerifyHostName(true);
// Other configuration settings
// ...
Conclusion
The missing TLS hostname verification vulnerability in the Apache ActiveMQ Client exposes the communication channel to potential attackers, allowing them to intercept and modify messages. To mitigate this risk, it is crucial to upgrade to the latest version of the client, which enables TLS hostname verification by default. Additionally, enabling this verification manually in the client configuration can serve as a temporary workaround. For further assistance in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
The vulnerability allows an attacker to intercept and modify the communication between a Java application using the ActiveMQ client and the ActiveMQ server. This can lead to unauthorized access, data leakage, and tampering of critical information.
To mitigate the risk of a MITM attack, it is crucial to upgrade to Apache ActiveMQ Client version 5.15.6 or later. Additionally, enabling TLS hostname verification in the client configuration provides an extra layer of security.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential attacks.
Yes, there are several alternative messaging client libraries available for Java, such as RabbitMQ and Apache Kafka. It is recommended to evaluate your specific requirements and choose a library that meets your needs while also considering security aspects.
For more information about this vulnerability, you can refer to the CVE-2018-11775 entry in the National Vulnerability Database (NVD) or the provided database-specific source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
