Apache ActiveMQ CVE-2019-0222: MQTT Frame Unmarshalling Vulnerability
Summary
CVE-2019-0222: In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. Affects activemq versions < 5.15.9-1. Fixed in 5.15.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that allows applications to communicate with each other using various messaging protocols. It provides reliable and scalable messaging services for distributed systems. ActiveMQ supports the MQTT protocol, which is widely used in IoT applications. However, a vulnerability has been discovered in ActiveMQ versions 5.0.0 to 5.15.8 that can lead to an Out of Memory exception and make the broker unresponsive when unmarshalling corrupt MQTT frames.
Vulnerability Detail
The vulnerability, identified as CVE-2019-0222, occurs when ActiveMQ attempts to process a corrupt MQTT frame. This can be exploited by an attacker to send specially crafted MQTT messages that trigger the Out of Memory exception. As a result, the broker becomes unresponsive and may require manual intervention to recover. The impact of this vulnerability can be severe, as it can lead to denial of service for the affected ActiveMQ instance.
How To Fix
Minimum fixed version
5.15.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Apache ActiveMQ.
Conclusion
The Apache ActiveMQ CVE-2019-0222 vulnerability exposes ActiveMQ instances to the risk of denial of service due to an Out of Memory exception. It is crucial to upgrade to the latest version of ActiveMQ to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates communication between applications using various messaging protocols.
The vulnerability can lead to an Out of Memory exception in ActiveMQ, making the broker unresponsive and causing denial of service.
ActiveMQ versions 5.0.0 to 5.15.8 are affected by this vulnerability.
No, there is no known workaround. It is recommended to upgrade to the latest version of ActiveMQ.
To fix this vulnerability, upgrade to Apache ActiveMQ version 5.15.9-1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
