CVE-2021-26117

Published on: 01/27/2021 12:00:00 AM UTC

Last Modified on: 12/07/2021 08:47:00 PM UTC

CVE-2021-26117

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Certain versions of Activemq from Apache contain the following vulnerability:

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

CVE-2021-26117 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
Affected Vendor/Software: Apache Software Foundation - Apache ActiveMQ version < 2.16.0
Affected Vendor/Software: Apache Software Foundation - Apache ActiveMQ version < 5.16.1
Affected Vendor/Software: Apache Software Foundation - Apache ActiveMQ version < 5.15.14

CVSS3 Score: 7.5 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	NONE	HIGH	NONE

CVSS2 Score: 5 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	LOW	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
NONE	PARTIAL	NONE

CVE References

Description	Tags ^ⓘ	Link
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
CVE-2021-26117 Apache ActiveMQ Vulnerability in NetApp Products \| NetApp Product Security	Third Party Advisory security.netapp.com text/html	CONFIRM security.netapp.com/advisory/ntap-20210304-0008/
[SECURITY] [DLA 2583-1] activemq security update	Mailing List Third Party Advisory lists.debian.org text/html	MLIST [debian-lts-announce] 20210305 [SECURITY] [DLA 2583-1] activemq security update
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210509 [jira] [Commented] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210421 [jira] [Created] (AMQ-8244) CVE-2021-26117 on AMQ 5.16.1
Pony Mail!	lists.apache.org text/html	MLIST [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev commented on pull request #3515: Update activmq5 version to fix CVE-2021-26117
Oracle Critical Patch Update Advisory - July 2021	www.oracle.com text/html	MISC www.oracle.com//security-alerts/cpujul2021.html
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210421 [jira] [Updated] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
Pony Mail!	lists.apache.org text/html	MLIST [activemq-gitbox] 20210409 [GitHub] [activemq-artemis] brusdev closed pull request #3515: Update activmq5 version to fix CVE-2021-26117
Oracle Critical Patch Update Advisory - October 2021	www.oracle.com text/html	MISC www.oracle.com/security-alerts/cpuoct2021.html
Pony Mail!	Mailing List Vendor Advisory lists.apache.org text/html	MLIST [announce] 20210128 CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210421 [jira] [Created] (AMQ-8246) CVE-2021-26117 still exists on 5.16.1
Pony Mail!	Mailing List Patch Vendor Advisory lists.apache.org text/html	MLIST [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210421 [jira] [Created] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1
CVE-2021-26117: ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind	Mailing List Vendor Advisory mail-archives.apache.org text/xml	MISC mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%[email protected].com%3e
Pony Mail!	lists.apache.org text/html	MLIST [activemq-issues] 20210509 [jira] [Deleted] (AMQ-8245) CVE-2021-26117 on AMQ 5.16.1
Pony Mail!	lists.apache.org text/html	MLIST [activemq-gitbox] 20210323 [GitHub] [activemq-artemis] trevorlinton opened a new pull request #3515: Update activmq5 version to fix CVE-2021-26117
Oracle Critical Patch Update Advisory - April 2021	www.oracle.com text/html	MISC www.oracle.com/security-alerts/cpuApr2021.html
Pony Mail!	Mailing List Vendor Advisory lists.apache.org text/html	MLIST [activemq-commits] 20210128 [activemq-website] branch master updated: CVE-2021-26117 - add mitigation section

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

179811 Debian Security Update for activemq (CVE-2021-26117)
730055 Apache ActiveMQ LDAP-Authentication Vulnerability (CVE-2021-26117)
980334 Java (maven) Security Update for org.apache.activemq:apache-artemis (GHSA-9mgm-gcq8-86wq)

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apache	Activemq	All	All	All	All
Application	Apache	Activemq	All	All	All	All
Application	Apache	Activemq Artemis	All	All	All	All
Application	Apache	Activemq Artemis	All	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	Netapp	Oncommand Workflow Automation	-	All	All	All
Application	Netapp	Oncommand Workflow Automation	-	All	All	All
Application	Oracle	Communications Element Manager	All	All	All	All
Application	Oracle	Communications Session Report Manager	All	All	All	All
Application	Oracle	Communications Session Route Manager	All	All	All	All
Application	Oracle	Flexcube Private Banking	12.0.0	All	All	All
Application	Oracle	Flexcube Private Banking	12.1.0	All	All	All

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*:
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*:
cpe:2.3:a:apache:activemq_artemis:*:*:*:*:*:*:*:*:
cpe:2.3:a:apache:activemq_artemis:*:*:*:*:*:*:*:*:
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*:
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*:
cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*:
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*:
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*:
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*:
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*:

Discovery Credit

Apache ActiveMQ would like to thank Gregor Tudan for reporting this issue.

Social Mentions

Source	Title	Posted (UTC)