https://bugzilla.redhat.com/show_bug.cgi?id=1696012
Bug ID: 1696012
Summary: CVE-2019-0222 activemq: Corrupt MQTT frame can cause
broker shutdown
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190327,reported=20190327,sour
ce=cve,cvss3=5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/
I:N/A:H,fedora-all/activemq=affected,jbds-11/activemq=
new,amq-6/activemq=new,jdg-7/activemq-artemis=new,eap-
7/activemq-artemis=new,fsw-6/activemq=new,fuse-6/activ
emq=new,rhdm-7/activemq-artemis=new,fuse-7/activemq=ne
w,rhpam-7/activemq-artemis=new,rhev-m-4/eap7-activemq-
artemis=new,rhsso-7/activemq-artemis=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dfediuck(a)redhat.com,
dimitris(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eedri(a)redhat.com,
etirelli(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rnetuka(a)redhat.com, rrajasek(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sbonazzo(a)redhat.com, sdaley(a)redhat.com,
sherold(a)redhat.com, s(a)shk.io, sthorger(a)redhat.com,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tkirby(a)redhat.com, twalsh(a)redhat.com,
vtunka(a)redhat.com
Target Milestone: ---
Classification: Other
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to
broker Out of Memory exception making it unresponsive.
References:
http://activemq.apache.org/security-advisories.data/CVE-2019-0222-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.