[AMQ-7019] ActiveMQ 5.15.4 jolokia.jar which has one high severity CVE against it. - ASF JIRA

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Blocker
Resolution: Fixed
Affects Version/s: 5.15.4
Fix Version/s: 5.15.5, 5.16.0
Component/s: Web Console
Labels:
None
Environment:

Hide

Customer environment is a mix of Linux and Windows, Gig-LAN (Medical & Finacial services). Will not accept the risk of having even one high severity CVE in thier environment. The cost of (SOX/HIPPA) insurence is too high to allow even one CVE with newly deployed systems.

Show
Customer environment is a mix of Linux and Windows, Gig-LAN (Medical & Finacial services). Will not accept the risk of having even one high severity CVE in thier environment. The cost of (SOX/HIPPA) insurence is too high to allow even one CVE with newly deployed systems.

Description

ActiveMQ 5.15.4 jolokia.jar which has one high severity CVE against it.
Discovered by adding OWASP Dependency check into ActiveMQ pom.xml and running the OWASP report.

CVE-2015-5182 Severity:High CVSS Score: 6.8
allows Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=1248809 CONFIRM

Attachments

Activity

People

Assignee:: Unassigned

Reporter:: Albert Baker

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Dates

Created:: 23/Jul/18 23:05

Updated:: 28/Jul/18 02:33

Resolved:: 27/Jul/18 12:18