CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
A flaw was found in activemq. When anonymous binds are enabled on the LDAP provider (zero length DN/password) and the LDAP module is configured to make use of these, client credentials are not correctly verified and authentication is effectively bypassed. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in Red Hat AMQ 6 and ActiveMQ Artemis (Red Hat AMQ 7) with the LDAP login module, if anonymous binds are enabled on the LDAP provider (zero length DN/password) and the LDAP module is configured to make use of these, client credentials are not correctly verified and authentication is effectively bypassed.
Upstream Issue: https://issues.apache.org/jira/browse/ARTEMIS-2895
— Red Hat
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/activemq-artemis-2.16.0 redhat-amq-7.8.0 redhat-amqto a version that resolves this vulnerability.Fixed in 7.4.5 - Upgrade
Upgrade
maven/org.apache.activemq:apache-artemisto a version that resolves this vulnerability.Fixed in 2.16.0 - Upgrade
Upgrade
maven/org.apache.activemq:activemq-parentto a version that resolves this vulnerability.Fixed in 5.15.14 - Upgrade
Upgrade
maven/org.apache.activemq:activemq-parentto a version that resolves this vulnerability.Fixed in 5.16.1 - Upgrade
Upgrade
debian/activemqto a version that resolves this vulnerability.Fixed in 5.16.1-1Fixed in 5.16.1-1+deb11u1Fixed in 5.17.2+dfsg-2+deb12u1Fixed in 5.17.6+dfsg-1 - Upgrade
Upgrade
debian/activemqto a version that resolves this vulnerability.Fixed in 5.16.1-1 - Upgrade
Upgrade
debian/activemqto a version that resolves this vulnerability.Fixed in 5.16.1-1+deb11u1 - Upgrade
Upgrade
debian/activemqto a version that resolves this vulnerability.Fixed in 5.17.2+dfsg-2+deb12u1 - Upgrade
Upgrade
debian/activemqto a version that resolves this vulnerability.Fixed in 5.17.6+dfsg-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2021-26117.
What is the severity of CVE-2021-26117?
The severity of CVE-2021-26117 is high with a CVSS score of 8.1.
Which software packages are affected by CVE-2021-26117?
The affected software packages include activemq-artemis-2.16.0, redhat-amq-7.8.0, redhat-amq, Apache ActiveMQ, Apache ActiveMQ Artemis, NetApp OnCommand Workflow Automation, and Debian Debian Linux.
How can I fix CVE-2021-26117?
To fix CVE-2021-26117, you should apply the recommended remedy or update to version 7.4.5 for activemq-artemis-2.16.0, redhat-amq-7.8.0, and redhat-amq.
Where can I find more information about CVE-2021-26117?
You can find more information about CVE-2021-26117 at the following references: [Link 1](https://issues.apache.org/jira/browse/ARTEMIS-2895), [Link 2](https://www.openwall.com/lists/oss-security/2021/01/27/6), [Link 3](https://access.redhat.com/errata/RHSA-2021:0384).