{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:051af8f8-e036-505e-ace6-75c9fead006f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-parent", "purl": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2", "version": "6.1.8-tuxcare.2", "pedigree": { "ancestors": [ { "name": "activemq-parent", "purl": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8", "type": "library", "group": "org.apache.activemq", "version": "6.1.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-0684", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:dc43c6c9-2563-57aa-8088-ca22c5d662d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2010-0684 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 The target Apache ActiveMQ 6.1.8-tuxcare.2 is NOT affected by CVE-2010-0684 (XSS in createDestination.action). All three upstream vendor patches (commits 2895197d0, fed39c3619, 1f464b9412) addressing this XSS vulnerability are already present in the target's ancestry and were shipped in the upstream Apache ActiveMQ release before TuxCare onboarded version 6.1.8. The vulnerable pattern (unescape...", "justification": "code_not_present" } }, { "id": "CVE-2010-1244", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:5385c6f0-2a8d-5968-ad58-deba2aee843e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2010-1244 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 The target ActiveMQ 6.1.8 is NOT affected by CVE-2010-1244. The CSRF vulnerability described in the CVE was fixed in upstream ActiveMQ 5.3.1 (February 2010) and the fix is present in version 6.1.8. The fix implements a synchronizer token pattern: SessionFilter generates a random UUID per session and stores it as \"secret\", JSP pages embed this token in forms, and BindingBeanNameUrlHandlerMapping...", "justification": "code_not_present" } }, { "id": "CVE-2017-15709", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:a05762b5-210c-58fb-8e70-a07e82e2a9df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-15709 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2017-15709: The target ActiveMQ 6.1.8 is NOT AFFECTED. The vulnerability (system information disclosure via OpenWire protocol) was fixed in upstream commit 5fa0bbd51 (AMQ-6871) by Christopher L. Shannon, which was already included in the ActiveMQ 6.1.8 release that TuxCare onboarded. The fix changes the default behavior to send generic platform details (\"Java\") instead of detailed OS/kernel...", "justification": "code_not_present" } }, { "id": "CVE-2020-11998", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:6817277b-d0ee-54d8-9a65-ed7826ae366b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11998 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2020-11998 describes a JMX regression where an empty environment map was passed to RMIConnectorServer instead of one containing authentication credentials, enabling remote code execution via malicious MBean creation. The target (Apache ActiveMQ 6.1.8-tuxcare.2) is NOT AFFECTED because the upstream fix (commit aa8900ca7 by Apache developer coheigea@apache.org, dated May 22, 2020) was already...", "justification": "code_not_present" } }, { "id": "CVE-2020-13920", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:f45efd30-5013-5181-96ca-75212b694411", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13920 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 The target repository (Apache ActiveMQ 6.1.8) is NOT vulnerable to CVE-2020-13920. The vulnerability, which allowed unauthenticated attackers to rebind JMX RMI registry entries to perform man-in-the-middle attacks and intercept credentials, was already fixed in the upstream Apache ActiveMQ 6.1.8 release before TuxCare onboarded it. The fix implements a custom RMI registry using a dynamic proxy ...", "justification": "code_not_present" } }, { "id": "CVE-2020-13947", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:49584292-87ad-5bd5-b6c6-7faf85f47707", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13947 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2020-13947 XSS vulnerability is NOT present in Apache ActiveMQ 6.1.8. The upstream fix (commit 4450c17c1) was applied on August 31, 2020, and was already included in version 6.1.8 when TuxCare onboarded it. Both the JSP file (message.jsp) and JavaScript file (message.js) contain proper URL encoding using JSTL / tags and encodeURIComponent() respectively, preventing the XSS a...", "justification": "code_not_present" } }, { "id": "CVE-2021-26117", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:d17d3d30-514b-544e-af71-7f2a46ca213c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-26117 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-parent. The target Apache ActiveMQ 6.1.8-tuxcare.2 is not affected by CVE-2021-26117. The LDAP authentication bypass vulnerability (where anonymous LDAP context was incorrectly used for password verification) was fixed in upstream commit 73e29169 by gary.tully@gmail.com (AMQ-8035). This fix was already included in the upstream Apache ActiveMQ 6.1.8 release that TuxCare onboarded, before any TuxCare maintenance work began. The fix forces \"simple\" authentication mode during password bind operations, ensuring password validation occurs even when the initial LDAP connection uses anonymous authentication.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.16.0, < 5.16.1; < 5.15.14), NVD (>= 5.15.0, < 5.15.14; >= 5.16.0, < 5.16.1), cve.org (< 2.16.0; < 5.15.14), Snyk (>= 5.16.0, < 5.16.1; < 5.15.14).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.8-tuxcare.2" } ] }