Vulnerability · Published Jan 27, 2021 · Assigned by apache
CVE-2021-26117ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
High 7.5
In plain English
A high-severity improper authentication in Apache ActiveMQ from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.3% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | 5.16.1-1 | DEBIAN-CVE-2021-26117 |
| Debian:13 | activemq | 5.16.1-1 | DEBIAN-CVE-2021-26117 |
| Maven | org.apache.activemq:activemq-parent | 5.16.1 | GHSA-9mgm-gcq8-86wq |
| Maven | org.apache.activemq:activemq-parent | 5.15.14 | GHSA-9mgm-gcq8-86wq |
| Maven | org.apache.activemq:apache-artemis | 2.16.0 | GHSA-9mgm-gcq8-86wq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ActiveMQ | Apache ActiveMQ Artemis – before 2.16.0Apache ActiveMQ – before 5.16.1 |
Weakness: CWE-287
References
- https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA%40mail.gmail.com%3e
- [activemq-commits] 20210128 [activemq-website] branch master updated: CVE-2021-26117 - add mitigation section mailing-list
- [announce] 20210128 CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind mailing-list
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947 mailing-list
- [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update mailing-list
- [activemq-gitbox] 20210323 [GitHub] [activemq-artemis] trevorlinton opened a new pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev commented on pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev closed pull request #3515: Update activmq5 version to fix CVE-2021-26117 mailing-list
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Created] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Commented] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1 mailing-list
- [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210304-0008/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [debian-lts-announce] 20231120 [SECURITY] [DLA 3657-1] activemq security update mailing-list