CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support
First published: Wed Jan 27 2021(Updated: )
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache ActiveMQ Artemis | =2.15.0 | |
| NetApp OnCommand Workflow Automation |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-26118
- https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574@%3Cannounce.apache.org%3E
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3CCAH%2BvQmMUNnkiXv2-d3ucdErWOsdnLi6CgnK%2BVfixyJvTgTuYig%40mail.gmail.com%3E
- https://security.netapp.com/advisory/ntap-20210827-0002/
- https://github.com/apache/activemq-artemis/commit/e5566d52116d81611d914548adc3cbb14d7118d4
- https://github.com/advisories/GHSA-q7fr-vqhq-v5xr (Advisory)
- https://lists.apache.org/thread.html/rafd5d7cf303772a0118865262946586921a65ebd98fc24f56c812574%40%3Cannounce.apache.org%3E
Frequently Asked Questions
What is CVE-2021-26118?
CVE-2021-26118 is a vulnerability that allows the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 to bypass policy based access control.
How does CVE-2021-26118 affect Apache ActiveMQ Artemis?
CVE-2021-26118 affects Apache ActiveMQ Artemis 2.15.0 by allowing the creation of advisory messages without proper access control.
What is the severity of CVE-2021-26118?
CVE-2021-26118 has a severity rating of 7.5 (High).
How can I fix CVE-2021-26118?
To fix CVE-2021-26118, you should upgrade to Apache ActiveMQ Artemis 2.16.0 or a later version.
Where can I find more information about CVE-2021-26118?
You can find more information about CVE-2021-26118 on the NIST National Vulnerability Database (NVD) website.
- collector/github-advisory-latest
- alias/GHSA-q7fr-vqhq-v5xr
- alias/CVE-2021-26118
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/author
- agent/softwarecombine
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- package-manager/maven
- vendor/apache
- canonical/apache activemq artemis
- version/apache activemq artemis/2.15.0
- vendor/netapp
- canonical/netapp oncommand workflow automation