[AMQ-7019] ActiveMQ 5.15.4 jolokia.jar which has one high severity CVE against it.

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 5.15.4
• Fix Version/s: 5.15.5, 5.16.0
• Component/s: Web Console

Environment

Customer environment is a mix of Linux and Windows, Gig-LAN (Medical & Finacial services).  Will not accept the risk of having even one high severity CVE in thier environment. The cost of (SOX/HIPPA) insurence is too high to allow even one CVE with newly deployed systems.

• Assignee: Unassigned
• Reporter: Albert Baker
• Created: 24/Jul/18 02:05
• Updated: 28/Jul/18 05:33
• Resolved: 27/Jul/18 15:18

Description

ActiveMQ 5.15.4 jolokia.jar which has one high severity CVE against it.
Discovered by adding OWASP Dependency check into ActiveMQ pom.xml and running the OWASP report.

CVE-2015-5182 Severity:High  CVSS Score: 6.8
allows Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1248809 CONFIRM