Skip to main content

CVE-2018-11775

Severity

5.9

Description

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

Project

Apache TomEE

Apache ActiveMQ

Category
Missing TLS Hostname Verification
Tags
data
Date Disclosed

2018-09-10

Date Discovered

2018-06-05

Apache TomEE 7.1.x

First release:
2018-09-02
0
Support Lifecycle:
Namespace:
javax
7.1.0

Apache TomEE 7.0.x

First release:
2016-05-17
0
Support Lifecycle:
Namespace:
javax
7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.0.9

Apache ActiveMQ 5.15.x

First release:
2017-06-27
0
Support Lifecycle:
Namespace:
javax
5.15.05.15.15.15.25.15.35.15.45.15.5

Apache ActiveMQ 5.14.x

First release:
2016-08-02
0
Support Lifecycle:
Namespace:
javax
5.14.05.14.15.14.25.14.35.14.45.14.5

Apache ActiveMQ 5.13.x

First release:
2015-11-30
0
Support Lifecycle:
Namespace:
javax
5.13.05.13.15.13.25.13.35.13.45.13.5

Apache TomEE 1.7.x

First release:
2014-08-09
0
Support Lifecycle:
Namespace:
javax
1.7.01.7.11.7.21.7.31.7.41.7.5

Apache TomEE 1.6.x

First release:
2013-11-17
0
Support Lifecycle:
Namespace:
javax
1.6.01.6.0.11.6.0.2

Apache TomEE 1.5.x

First release:
2012-09-28
0
Support Lifecycle:
Namespace:
javax
1.5.01.5.11.5.2

Apache TomEE 1.0.x

First release:
2012-04-27
0
Support Lifecycle:
Namespace:
javax
1.0.0
Feel Vulnerable? 

Contact us so we can help you.


* These fields are required.