Bug 1257246 (CVE-2015-6524)

Summary: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, bleanhar, ccoleman, chazlett, dmcphers, gvarsami, java-sig-commits, jcoleman, jgoulding, jialiu, joelsmith, jokerman, ldimaggi, lmeyer, mmccomas, nwallace, rwagner, soa-p-jira, s, tcunning, tdawson, tkirby, weli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: activemq-5.10.1, activemq-5.11.0 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 00:46:24 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1319874, 1257247, 1257248    
Bug Blocks: 1257253, 1385169    

Description Adam Mariš 2015-08-26 15:01:11 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2015-6524 to the following vulnerability:

The LDAPLoginModule implementation the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack.

Comment 2 Adam Mariš 2015-08-26 15:02:32 UTC
Created activemq tracking bugs for this issue:

Affects: fedora-all [bug 1257248]

Comment 3 Fedora Update System 2015-10-03 17:37:57 UTC
activemq-5.6.0-12.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-10-04 22:51:07 UTC
activemq-5.6.0-12.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.