[Bug 1257246] New: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Bug ID: 1257246 Summary: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: agrimm@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kseifried@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, s@shk.io, tdawson@redhat.com, weli@redhat.com
Common Vulnerabilities and Exposures assigned an identifier CVE-2015-6524 to the following vulnerability:
The LDAPLoginModule implementation the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack.
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1257247 Depends On| |1257248
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1257248 [Bug 1257248] CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
--- Comment #2 from Adam Mariš amaris@redhat.com ---
Created activemq tracking bugs for this issue:
Affects: fedora-all [bug 1257248]
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1257253
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- activemq-5.6.0-12.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1257246 Bug 1257246 depends on bug 1257248, which changed state.
Bug 1257248 Summary: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1257248
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
--- Comment #4 from Fedora Update System updates@fedoraproject.org --- activemq-5.6.0-12.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |0824,reported=20150824,sour |0824,reported=20150824,sour |ce=cve,cvss2=4.9/AV:N/AC:M/ |ce=cve,cvss2=4.9/AV:N/AC:M/ |Au:S/C:P/I:N/A:P,openshift- |Au:S/C:P/I:N/A:P,openshift- |enterprise-2/activemq=affec |enterprise-2/activemq=affec |ted,openshift-1/activemq=af |ted,fedora-all/activemq=aff |fected,fedora-all/activemq= |ected,amq-6/activemq=notaff |affected,openshift-enterpri |ected,fuse-6/activemq=notaf |se-1/activemq=affected,jbos |fected,fsw-6/activemq=affec |s/fuse-mq-7=affected,jboss/ |ted |fuse-mq-5.4=affected,jboss/ | |fuse-mq-5.5=affected,jboss/ | |amq-6=affected,jboss/others | |=affected |
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1319874
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1385169
java-sig-commits@lists.fedoraproject.org
-
Red Hat Bugzilla