Uploaded image for project: 'ActiveMQ Classic'
  1. ActiveMQ Classic
  2. AMQ-7492

Upgrade to Apache Camel 2.25.2

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 5.15.13
    • 5.15.14, 5.16.1, 5.17.0
    • AMQP

    Description

      CVE-2020-11971 needs AMQ to upgrade to Apache Camel 3.2.0
      Refer
      https://www.openwall.com/lists/oss-security/2020/05/14/7 and
      https://github.com/apache/camel/pull/3692

      Can you please upgrade Apache ActiveMQ to use non vlnerable Apache Camel 3.2.0?

      Following is the information from Sonatype Nexus Audior reported issue on AMQ 5.15.13

      Description :
      Severity : CVE CVSS 3: 7.5Sonatype CVSS 3: 7.5

      Weakness : CVE CWE: 20

      Source : National Vulnerability Database

      Categories : Data

      Description from CVE : Apache Camels JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.

      Explanation : This issue has undergone the Sonatype Fast-Track process. For more information, please see the Sonatype Knowledge Base Guide.

      Advisories : Project: https://github.com/apache/camel/pull/3692

      CVSS Details : CVE CVSS 3: 7.5CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

      CVE : CVE-2020-11971

      URL : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11971

      Remediation : This component does not have any non-vulnerable Version. Please contact the vendor to get this vulnerability fixed.

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            jbonofre Jean-Baptiste Onofré
            arajwade Abhijit Rajwade
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 20m
                20m

                Slack

                  Issue deployment