Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS00dmhmLTJodjctOG1yeM4AATvN
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Permalink: https://github.com/advisories/GHSA-4vhf-2hv7-8mrxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00dmhmLTJodjctOG1yeM4AATvN
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 4 months ago
CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-4vhf-2hv7-8mrx, CVE-2014-3600
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-3600
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100722
- https://issues.apache.org/jira/browse/AMQ-5333
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
- http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt
- http://seclists.org/oss-sec/2015/q1/427
- https://github.com/apache/activemq/commit/3e5ac6326db59f524a0e71f6b717428607d7b67d
- https://github.com/advisories/GHSA-4vhf-2hv7-8mrx
Blast Radius: 38.0
Affected Packages
maven:org.apache.activemq:activemq-broker
Dependent packages: 537Dependent repositories: 7,528
Downloads:
Affected Version Ranges: >= 5.0.0, < 5.10.1
Fixed in: 5.10.1
All affected versions: 5.8.0, 5.9.0, 5.9.1, 5.10.0
All unaffected versions: 5.10.1, 5.10.2, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.14.5, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2
maven:org.apache.activemq:activemq-client
Dependent packages: 410Dependent repositories: 6,414
Downloads:
Affected Version Ranges: >= 5.0.0, < 5.10.1
Fixed in: 5.10.1
All affected versions: 5.8.0, 5.9.0, 5.9.1, 5.10.0
All unaffected versions: 5.10.1, 5.10.2, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.14.5, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2