CVE编号
CVE-2021-26117利用情况
暂无补丁情况
官方补丁披露时间
2021-01-28漏洞描述
Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。Apache ActiveMQ LDAP login module存在授权问题漏洞，该漏洞源于匿名上下文用于验证错误的有效用户密码，导致未检查密码。目前没有详细的漏洞细节提供。
解决建议
厂商已发布了漏洞修复程序，请及时关注更新：https://issues.apache.org/jira/browse/AMQ-8035
参考链接 |
|
|---|---|
| https://lists.apache.org/thread.html/r110cacfa754471361234965ffe851a046e302ff... | |
| https://lists.apache.org/thread.html/r22cdc0fb45e223ac92bc2ceff7af92f1193dfc6... | |
| https://lists.apache.org/thread.html/r3341d96d8f956e878fb7b463b08d57ca1d58fec... | |
| https://lists.apache.org/thread.html/r519bfafd67091d0b91243efcb1c49b1eea27321... | |
| https://lists.apache.org/thread.html/r5899ece90bcae5805ad6142fdb05c58595cff19... | |
| https://lists.apache.org/thread.html/r70389648227317bdadcdecbd9f238571a604746... | |
| https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438... | |
| https://lists.apache.org/thread.html/ra255ddfc8b613b80e9fa22ff3e106168b245f38... | |
| https://lists.apache.org/thread.html/raea451de09baed76950d6a60cc4bb1b74476c50... | |
| https://lists.apache.org/thread.html/rd05b1c9d61dbd220664d559aa0e2b55e5830f00... | |
| https://lists.apache.org/thread.html/rd75600cee29cb248d548edcf6338fe296466d63... | |
| https://lists.apache.org/thread.html/re1b98da90a5f2e1c2e2d50e31c12e2578d61fe0... | |
| https://lists.apache.org/thread.html/rec93794f8aeddf8a5f1a643d264b4e66b933f06... | |
| https://lists.apache.org/thread.html/rffa5cd05d01c4c9853b17f3004d80ea6eb8856c... | |
| https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html | |
| https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+v... | |
| https://security.netapp.com/advisory/ntap-20210304-0008/ | |
| https://www.oracle.com//security-alerts/cpujul2021.html | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | |
| https://www.oracle.com/security-alerts/cpuoct2021.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | apache | activemq | * |
From (including) 5.15.0 |
Up to (excluding) 5.15.14 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | activemq | * |
From (including) 5.16.0 |
Up to (excluding) 5.16.1 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | activemq_artemis | * |
Up to (excluding) 2.16.0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | activemq | * |
Up to (excluding) 5.15.8-2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | activemq | * |
Up to (excluding) 5.16.0-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | activemq | * |
Up to (excluding) 5.14.3-3+deb9u2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | activemq | * |
Up to (excluding) 5.16.0-1 |
|||||
- 攻击路径 远程
- 攻击复杂度 容易
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 N/A
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 N/A
还没有评论，来说两句吧...