~ / search / GHSA-836g-5fr5-fgcr

GHSA-836g-5fr5-fgcr

Missing Authentication for Critical Function in Apache TomEE

Source: GitHub Advisory Database (reviewed) High CVE-2020-11969

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomee:tomee >= 8.0.0-M1, < 8.0.2 8.0.2
Maven org.apache.tomee:tomee >= 7.1.0, < 7.1.3 7.1.3
Maven org.apache.tomee:tomee >= 7.0.0-M1, < 7.0.8 7.0.8
Maven org.apache.tomee:tomee >= 1.0.0, < 1.7.6 1.7.6

Details

As written in the advisory (Markdown source, shown as plain text).

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.

References

External links from the advisory. They lead to third-party sites.