CVE-2017-15709

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

References

Affected packages

Git / github.com/apache/activemq

Affected ranges

Type

GIT

Repo

https://github.com/apache/activemq

Events

Introduced

71cbc652835e8b6b9d17b7a28fc998fce4840a9b

Last affected

9e595d8674456810ee3bd2d4a9920ed8b680937b

Database specific

{
    "cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.14.0"
        },
        {
            "last_affected": "5.15.2"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

activemq-5.*

activemq-5.14.0

activemq-5.15.0

activemq-5.15.1

activemq-5.15.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-15709.json"