REDHAT-BUG-2364684: Medium severity Apache ActiveMQ vulnerability
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.
During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.
Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.
Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2364684?
The severity of REDHAT-BUG-2364684 is considered high due to the potential for denial of service attacks.
How do I fix REDHAT-BUG-2364684?
To fix REDHAT-BUG-2364684, you should upgrade to a patched version of Apache ActiveMQ as specified in the security advisory.
Which versions of Apache ActiveMQ are affected by REDHAT-BUG-2364684?
REDHAT-BUG-2364684 affects Apache ActiveMQ versions from 5.16.0 to 6.1.6, including several 5.x versions.
What type of vulnerability is REDHAT-BUG-2364684?
REDHAT-BUG-2364684 is a memory allocation vulnerability that can lead to excessive memory usage and potential denial of service.
What can attackers exploit in REDHAT-BUG-2364684?
Attackers can exploit REDHAT-BUG-2364684 by sending specially crafted OpenWire commands that cause excessive memory allocation.