<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
	<DocumentTitle xml:lang="en">An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2</DocumentTitle>
	<DocumentType>Security Advisory</DocumentType>
	<DocumentPublisher Type="Vendor">
		<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
		<IssuingAuthority>openEuler security committee</IssuingAuthority>
	</DocumentPublisher>
	<DocumentTracking>
		<Identification>
			<ID>openEuler-SA-2023-1925</ID>
		</Identification>
		<Status>Final</Status>
		<Version>1.0</Version>
		<RevisionHistory>
			<Revision>
				<Number>1.0</Number>
				<Date>2023-12-15</Date>
				<Description>Initial</Description>
			</Revision>
		</RevisionHistory>
		<InitialReleaseDate>2023-12-15</InitialReleaseDate>
		<CurrentReleaseDate>2023-12-15</CurrentReleaseDate>
		<Generator>
			<Engine>openEuler SA Tool V1.0</Engine>
			<Date>2023-12-15</Date>
		</Generator>
	</DocumentTracking>
	<DocumentNotes>
		<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">activemq security update</Note>
		<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.</Note>
		<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">The most popular and powerful open source messaging and Integration Patterns server.

Security Fix(es):

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. 

In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke
through refection.

And then, RCE is able to be achieved via
jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.
A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
(CVE-2022-41678)</Note>
		<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for activemq is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS,openEuler-22.03-LTS-SP1 and openEuler-22.03-LTS-SP2.

openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
		<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
		<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">activemq</Note>
	</DocumentNotes>
	<DocumentReferences>
		<Reference Type="Self">
			<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1925</URL>
		</Reference>
		<Reference Type="openEuler CVE">
			<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-41678</URL>
		</Reference>
		<Reference Type="Other">
			<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-41678</URL>
		</Reference>
	</DocumentReferences>
	<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
		<Branch Type="Product Name" Name="openEuler">
			<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
			<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
			<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
			<FullProductName ProductID="openEuler-22.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">openEuler-22.03-LTS-SP1</FullProductName>
			<FullProductName ProductID="openEuler-22.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">openEuler-22.03-LTS-SP2</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="noarch">
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">activemq-5.16.7-1.oe1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-javadoc-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">activemq-javadoc-5.16.7-1.oe1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-javadoc-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">activemq-javadoc-5.16.7-1.oe1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">activemq-5.16.7-1.oe1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-javadoc-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">activemq-javadoc-5.16.7-1.oe2203.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">activemq-5.16.7-1.oe2203.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">activemq-5.16.7-1.oe2203sp1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-javadoc-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">activemq-javadoc-5.16.7-1.oe2203sp1.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-javadoc-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">activemq-javadoc-5.16.7-1.oe2203sp2.noarch.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">activemq-5.16.7-1.oe2203sp2.noarch.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="src">
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">activemq-5.16.7-1.oe1.src.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">activemq-5.16.7-1.oe1.src.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">activemq-5.16.7-1.oe2203.src.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">activemq-5.16.7-1.oe2203sp1.src.rpm</FullProductName>
			<FullProductName ProductID="activemq-5.16.7-1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP2">activemq-5.16.7-1.oe2203sp2.src.rpm</FullProductName>
		</Branch>
	</ProductTree>
	<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
		<Notes>
			<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allowsorg.jolokia.http.AgentServlet to handler request to /api/jolokiaorg.jolokia.http.HttpRequestHandler#handlePostRequest is able tocreate JmxRequest through JSONObject. And calls toorg.jolokia.http.HttpRequestHandler#executeRequest.Into deeper calling stacks,org.jolokia.handler.ExecHandler#doHandleRequest is able to invokethrough refection.And then, RCE is able to be achieved viajdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.1 Call newRecording.2 Call setConfiguration. And a webshell data hides in it.3 Call startRecording.4 Call copyTo method. The webshell will be written to a .jsp file.The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</Note>
		</Notes>
		<ReleaseDate>2023-12-15</ReleaseDate>
		<CVE>CVE-2022-41678</CVE>
		<ProductStatuses>
			<Status Type="Fixed">
				<ProductID>openEuler-20.03-LTS-SP1</ProductID>
				<ProductID>openEuler-20.03-LTS-SP3</ProductID>
				<ProductID>openEuler-22.03-LTS</ProductID>
				<ProductID>openEuler-22.03-LTS-SP1</ProductID>
				<ProductID>openEuler-22.03-LTS-SP2</ProductID>
			</Status>
		</ProductStatuses>
		<Threats>
			<Threat Type="Impact">
				<Description>High</Description>
			</Threat>
		</Threats>
		<CVSSScoreSets>
			<ScoreSet>
				<BaseScore>8.8</BaseScore>
				<Vector>AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
			</ScoreSet>
		</CVSSScoreSets>
		<Remediations>
			<Remediation Type="Vendor Fix">
				<Description>activemq security update</Description>
				<DATE>2023-12-15</DATE>
				<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1925</URL>
			</Remediation>
		</Remediations>
	</Vulnerability>
</cvrfdoc>