CVE-2020-11998: Code Injection
First published: Thu Sep 10 2020(Updated: )
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache ActiveMQ | =5.15.12 | |
| Oracle Communications Diameter Signaling Router | >=8.0.0<=8.5.0 | |
| Oracle Communications Element Manager | >=8.2.0<=8.2.4.0 | |
| Oracle Communications Session Report Manager | >=8.0.0<=8.2.2 | |
| Oracle Communications Session Route Manager | >=8.0.0<=8.2.2 | |
| Oracle Enterprise Repository | =11.1.1.7.0 | |
| Oracle FLEXCUBE Private Banking | =12.0.0 | |
| Oracle FLEXCUBE Private Banking | =12.1.0 | |
| maven/org.apache.activemq:activemq-parent | =5.15.12 | 5.15.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-11998
- https://github.com/apache/activemq/commit/0d6e5f2
- https://github.com/apache/activemq/commit/88b78d0
- https://github.com/apache/activemq/commit/aa8900c
- https://github.com/advisories/GHSA-wqfh-9m4g-7x6x (Advisory)
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
Frequently Asked Questions
What is CVE-2020-11998?
CVE-2020-11998 is a vulnerability that allows an attacker to bypass authentication in Apache ActiveMQ and Oracle Communications products.
How severe is CVE-2020-11998?
CVE-2020-11998 has a severity rating of 9.8, which is considered critical.
Which software products are affected by CVE-2020-11998?
CVE-2020-11998 affects Apache ActiveMQ version 5.15.12 and Oracle Communications products including Diameter Signaling Router, Element Manager, Session Report Manager, Session Route Manager, Enterprise Repository, and FLEXCUBE Private Banking.
How can an attacker exploit CVE-2020-11998?
An attacker can exploit CVE-2020-11998 by passing an empty environment map to RMIConnectorServer in order to bypass authentication.
Are there any references for CVE-2020-11998?
Yes, you can find references for CVE-2020-11998 at the following links: [Reference 1](http://activemq.apache.org/security-advisories.data/CVE-2020-11998-announcement.txt), [Reference 2](https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E), [Reference 3](https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wqfh-9m4g-7x6x
- alias/CVE-2020-11998
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/event
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache activemq
- version/apache activemq/5.15.12
- vendor/oracle
- canonical/oracle communications diameter signaling router
- version/oracle communications diameter signaling router/8.0.0
- version/oracle communications diameter signaling router/8.5.0
- canonical/oracle communications element manager
- version/oracle communications element manager/8.2.0
- version/oracle communications element manager/8.2.4.0
- canonical/oracle communications session report manager
- version/oracle communications session report manager/8.0.0
- version/oracle communications session report manager/8.2.2
- canonical/oracle communications session route manager
- version/oracle communications session route manager/8.0.0
- version/oracle communications session route manager/8.2.2
- canonical/oracle enterprise repository
- version/oracle enterprise repository/11.1.1.7.0
- canonical/oracle flexcube private banking
- version/oracle flexcube private banking/12.0.0
- version/oracle flexcube private banking/12.1.0
- package-manager/maven