CVE-2021-26118
Summary
| CVE | CVE-2021-26118 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-01-27 19:15:00 UTC |
| Updated | 2023-11-07 03:31:00 UTC |
| Description | While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Activemq Artemis | 2.15.0 | All | All | All |
| Application | Apache | Activemq Artemis | 2.15.0 | All | All | All |
| Application | Netapp | Oncommand Workflow Automation | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support | MISC | mail-archives.apache.org | Mailing List, Vendor Advisory |
| CVE-2021-26118 Apache ActiveMQ Artemis Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Pony Mail! | MLIST | lists.apache.org | Mailing List, Patch, Vendor Advisory |
| [announce] 20210127 CVE-2021-26118: Flaw in ActiveMQ Artemis OpenWire support | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Apache ActiveMQ would like to thank Francesco Marchioni (Red Hat) for reporting this issue.
Legacy QID Mappings
- 981417 Java (maven) Security Update for org.apache.activemq:apache-artemis (GHSA-q7fr-vqhq-v5xr)