CVE-2017-12174: High severity Apache ActiveMQ Artemis vulnerability
An issue was found in the Artemis and HornetQ .When 3rd party tool send multicast messages to Artemis/HornetQ which is configured with UDP Disovery and JGroups Discovery, Artemis/HornetQ creates a huge byte array at receiving the unexpected multicast message. So, it results in heap memory exhaustion, full GC and OutOfMemoryError in the worst case.
Other sources
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Artemisto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
HornetQto a version that resolves this vulnerability.Fixed in 2.4.0 - Configuration
Reconfigure the product to not use UDP discovery or JGroups discovery (disable multicast discovery) until the product is upgraded to 2.4.0 to avoid processing unexpected multicast messages that create huge byte arrays and may cause heap exhaustion or OutOfMemoryError.
Artemis and HornetQ Discovery mechanism = disable UDP discovery and JGroups discovery
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12174?
CVE-2017-12174 is a medium severity vulnerability that can lead to heap memory exhaustion.
How do I fix CVE-2017-12174?
To fix CVE-2017-12174, upgrade Apache ActiveMQ Artemis and Redhat HornetQ to versions later than 2.4.0.
What systems are affected by CVE-2017-12174?
CVE-2017-12174 affects Apache ActiveMQ Artemis versions before 2.4.0 and Redhat HornetQ versions before 2.4.0.
What can happen if CVE-2017-12174 is exploited?
If exploited, CVE-2017-12174 may result in OutOfMemoryError due to excessive memory consumption.
Is CVE-2017-12174 related to JGroups discovery?
Yes, CVE-2017-12174 is specifically related to the use of UDP discovery and JGroups discovery.