Bug 2356520 (CVE-2025-27427)

Summary:	CVE-2025-27427 org.apache.activemq/artemis-core-client: Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adupliak, asoldano, ataylor, bbaranow, bmaxwell, boliveir, brian.stansberry, cmiranda, darran.lofthouse, dhanak, dkreling, dosoudil, drichtar, fmariani, fmongiar, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jkoops, jnethert, jpoth, jrokos, kverlaen, mnovotny, mosmerov, msochure, msvehla, nwallace, pcongius, pdelbell, pdrozd, peholase, pesilva, pjindal, pmackay, porcelli, pskopek, rguimara, rkieley, rmartinc, rowaters, rstancel, rstepani, smaestri, sthorger, tcunning, tom.jenkinson, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache ActiveMQ Artemis. This vulnerability allows a user with createDurableQueue or createNonDurableQueue permissions to augment the routing-type of an address without the createAddress permission. When combined with the send permission and automatic queue creation, an attacker could send messages with unsupported routing-types, bypassing intended restrictions.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-04-01 08:01:09 UTC

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.

This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.

Users are recommended to upgrade to version 2.40.0 which fixes the issue.