An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2023-1925
Final
1.0
1.0
2023-12-15
Initial
2023-12-15
2023-12-15
openEuler SA Tool V1.0
2023-12-15
activemq security update
An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.
The most popular and powerful open source messaging and Integration Patterns server.
Security Fix(es):
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke
through refection.
And then, RCE is able to be achieved via
jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call copyTo method. The webshell will be written to a .jsp file.
The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.
A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
(CVE-2022-41678)
An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
activemq
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1925
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-41678
https://nvd.nist.gov/vuln/detail/CVE-2022-41678
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
openEuler-22.03-LTS-SP1
openEuler-22.03-LTS-SP2
activemq-5.16.7-1.oe1.noarch.rpm
activemq-javadoc-5.16.7-1.oe1.noarch.rpm
activemq-javadoc-5.16.7-1.oe1.noarch.rpm
activemq-5.16.7-1.oe1.noarch.rpm
activemq-javadoc-5.16.7-1.oe2203.noarch.rpm
activemq-5.16.7-1.oe2203.noarch.rpm
activemq-5.16.7-1.oe2203sp1.noarch.rpm
activemq-javadoc-5.16.7-1.oe2203sp1.noarch.rpm
activemq-javadoc-5.16.7-1.oe2203sp2.noarch.rpm
activemq-5.16.7-1.oe2203sp2.noarch.rpm
activemq-5.16.7-1.oe1.src.rpm
activemq-5.16.7-1.oe1.src.rpm
activemq-5.16.7-1.oe2203.src.rpm
activemq-5.16.7-1.oe2203sp1.src.rpm
activemq-5.16.7-1.oe2203sp2.src.rpm
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allowsorg.jolokia.http.AgentServlet to handler request to /api/jolokiaorg.jolokia.http.HttpRequestHandler#handlePostRequest is able tocreate JmxRequest through JSONObject. And calls toorg.jolokia.http.HttpRequestHandler#executeRequest.Into deeper calling stacks,org.jolokia.handler.ExecHandler#doHandleRequest is able to invokethrough refection.And then, RCE is able to be achieved viajdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.1 Call newRecording.2 Call setConfiguration. And a webshell data hides in it.3 Call startRecording.4 Call copyTo method. The webshell will be written to a .jsp file.The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
2023-12-15
CVE-2022-41678
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP3
openEuler-22.03-LTS
openEuler-22.03-LTS-SP1
openEuler-22.03-LTS-SP2
High
8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
activemq security update
2023-12-15
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1925