https://bugzilla.redhat.com/show_bug.cgi?id=1629083
Bug ID: 1629083
Summary: CVE-2018-11775 activemq: ActiveMQ Client Missing TLS
Hostname Verification
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
bmcclain(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sbonazzo(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com, s(a)shk.io,
sthorger(a)redhat.com, tcunning(a)redhat.com,
tdawson(a)redhat.com, tkirby(a)redhat.com,
twalsh(a)redhat.com, vtunka(a)redhat.com, ylavi(a)redhat.com
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6
was missing which could make the client vulnerable to a MITM attack between a
Java application using the ActiveMQ client and the ActiveMQ server. This is now
enabled by default.
References:
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announ...
--
You are receiving this mail because:
You are on the CC list for the bug.