{"id":"CVE-2021-26117","aliases":["BIT-activemq-2021-26117","DEBIAN-CVE-2021-26117","DLA-2583-1","DLA-3657-1","EUVD-2021-1304","GHSA-9mgm-gcq8-86wq","UBUNTU-CVE-2021-26117","USN-6910-1"],"status":"published","title":"ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.11543,"percentile":0.96087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2021-01-27T00:00:00Z","modified":"2026-10-24T10:30:25Z","fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-parent","fixed_in":["5.16.1","5.15.14"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.activemq:apache-artemis","fixed_in":["2.16.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"activemq","fixed_in":["5.15.14","5.16.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"activemq","fixed_in":["5.16.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"activemq","fixed_in":["5.16.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","fixed_in":["5.13.2+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","fixed_in":["5.15.8-2~18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","fixed_in":["5.15.11-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:apache-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"activemq","ranges":[{"type":"SEMVER","events":[{"introduced":"5.15.0"},{"fixed":"5.15.14"},{"introduced":"5.16.0"},{"fixed":"5.16.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.3-3+deb9u2"}]}],"versions":["5.14.3-3","5.14.3-3+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-0+deb10u1"}]}],"versions":["5.15.10-1","5.15.11-1","5.15.8-2","5.15.9-1"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.1"}]}],"versions":["5.16.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.14"}]}],"versions":["4.1.1","4.1.2","5.0.0","5.1.0","5.10.0","5.10.1","5.10.2","5.11.0","5.11.1","5.11.2","5.11.3","5.11.4","5.12.0","5.12.1","5.12.2","5.12.3","5.13.0","5.13.1","5.13.2","5.13.3","5.13.4","5.13.5","5.14.0","5.14.1","5.14.2","5.14.3","5.14.4","5.14.5","5.15.0","5.15.1","5.15.10","5.15.11","5.15.12","5.15.13","5.15.2","5.15.3","5.15.4","5.15.5","5.15.6","5.15.7","5.15.8","5.15.9","5.2.0","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.6.0","5.7.0","5.8.0","5.9.0","5.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:apache-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","2.0.0","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.8.0","2.8.1","2.9.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.6.0+dfsg1-4+deb8u1ubuntu1","5.6.0+dfsg1-5","5.13.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8-2~18.04.1~esm1"}]}],"versions":["5.14.5-3","5.15.2-2","5.15.3-2","5.15.8-2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-1ubuntu0.1~esm1"}]}],"versions":["5.15.10-1","5.15.11-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.6.0+dfsg1-4+deb8u1ubuntu1","5.6.0+dfsg1-5","5.13.2+dfsg-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8-2~18.04.1~esm1"}]}],"versions":["5.14.5-3","5.15.2-2","5.15.3-2","5.15.8-2~18.04"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.11-1ubuntu0.1~esm1"}]}],"versions":["5.15.10-1","5.15.11-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"activemq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.1-1ubuntu0.1~esm1"}]}],"versions":["5.16.1-1"],"bundled":6}],"products":[{"vendor":"apache","product":"activemq"},{"vendor":"apache","product":"artemis"},{"vendor":"apache software foundation","product":"apache activemq"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"flexcube_private_banking"}],"references":[{"url":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA%40mail.gmail.com%3e","tags":["x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rffa5cd05d01c4c9853b17f3004d80ea6eb8856c422a8545c5f79b1a6%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re1b98da90a5f2e1c2e2d50e31c12e2578d61fe01c0737f9d0bd8de99%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r70389648227317bdadcdecbd9f238571a6047469d156bd72bb0ca2f7%40%3Cgitbox.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5899ece90bcae5805ad6142fdb05c58595cff19cb2e98cc58a91f55b%40%3Cgitbox.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rec93794f8aeddf8a5f1a643d264b4e66b933f06fd72a38f31448f0ac%40%3Cgitbox.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd75600cee29cb248d548edcf6338fe296466d63a69e2ed0afc439ec7%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/raea451de09baed76950d6a60cc4bb1b74476c505e03205a3c68c9808%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r110cacfa754471361234965ffe851a046e302ff2693b055f49f47b02%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r22cdc0fb45e223ac92bc2ceff7af92f1193dfc614c8b248534456229%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3341d96d8f956e878fb7b463b08d57ca1d58fec9c970aee929b58e0d%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r519bfafd67091d0b91243efcb1c49b1eea27321355ba5594f679277d%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd05b1c9d61dbd220664d559aa0e2b55e5830f006a09e82057f3f7863%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ra255ddfc8b613b80e9fa22ff3e106168b245f38a22316bfb54d21159%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210304-0008/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26117","tags":["web","advisory"]},{"url":"https://issues.apache.org/jira/browse/AMQ-8035","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/ARTEMIS-2895","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r70389648227317bdadcdecbd9f238571a6047469d156bd72bb0ca2f7@%3Cgitbox.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re1b98da90a5f2e1c2e2d50e31c12e2578d61fe01c0737f9d0bd8de99@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rffa5cd05d01c4c9853b17f3004d80ea6eb8856c422a8545c5f79b1a6@%3Ccommits.activemq.apache.org%3E","tags":["web"]},{"url":"https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA@mail.gmail.com%3e","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r5899ece90bcae5805ad6142fdb05c58595cff19cb2e98cc58a91f55b@%3Cgitbox.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rec93794f8aeddf8a5f1a643d264b4e66b933f06fd72a38f31448f0ac@%3Cgitbox.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r110cacfa754471361234965ffe851a046e302ff2693b055f49f47b02@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r22cdc0fb45e223ac92bc2ceff7af92f1193dfc614c8b248534456229@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/raea451de09baed76950d6a60cc4bb1b74476c505e03205a3c68c9808@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd75600cee29cb248d548edcf6338fe296466d63a69e2ed0afc439ec7@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3341d96d8f956e878fb7b463b08d57ca1d58fec9c970aee929b58e0d@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r519bfafd67091d0b91243efcb1c49b1eea27321355ba5594f679277d@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd05b1c9d61dbd220664d559aa0e2b55e5830f006a09e82057f3f7863@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra255ddfc8b613b80e9fa22ff3e106168b245f38a22316bfb54d21159@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/46a774c","tags":["web"]},{"url":"https://github.com/apache/activemq/commit/73e291693d59a96c0054fc7e7e09c2c67b192911","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210304-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9mgm-gcq8-86wq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-26117","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-26117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26117","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6910-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-7559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-46604","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-26117","title":"ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T00:00:00Z","modified":"2024-08-03T20:19:20.05Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-1304","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T00:00:00Z","modified":"2024-08-03T20:19:20Z","updated_at":"2026-11-03T03:24:51.962182Z"}],"ghsa":[{"id":"GHSA-9mgm-gcq8-86wq","title":"Improper Authentication in Apache ActiveMQ and Apache Artemis","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-06-16T17:39:35Z","modified":"2024-03-14T21:32:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2021-26117","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T19:15:13.72Z","modified":"2026-06-17T03:42:53.527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-26117","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T19:15:13.72Z","modified":"2026-10-24T10:30:25.923175347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-26117","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T19:15:13.72Z","modified":"2026-10-23T18:02:41.018724757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-9mgm-gcq8-86wq","title":"Improper Authentication in Apache ActiveMQ and Apache Artemis","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-06-16T17:39:35Z","modified":"2024-03-14T21:50:07.28616Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2021-26117","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2021-01-27T19:15:00Z","modified":"2026-02-04T03:13:05.996174Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-activemq-2021-26117","title":"ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind","description":"The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.","status":"published","published":"2025-12-03T14:35:35.296Z","modified":"2026-09-08T08:45:09.291302446Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"DLA-2583-1","title":"activemq - security update","status":"published","published":"2021-03-05T00:00:00Z","modified":"2026-03-09T01:19:31.149783Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3657-1","title":"activemq - security update","status":"published","published":"2023-11-20T00:00:00Z","modified":"2026-03-09T01:21:05.966667Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"USN-6910-1","title":"activemq vulnerabilities","description":"Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain\ncommands. A remote attacker could possibly use this issue to terminate\nthe program, resulting in a denial of service. This issue only affected\nUbuntu 16.04 LTS. (CVE-2015-7559)\n\nPeter Stöckli discovered that Apache ActiveMQ incorrectly handled\nhostname verification. A remote attacker could possibly use this issue\nto perform a person-in-the-middle attack. This issue only affected Ubuntu\n16.04 LTS. (CVE-2018-11775)\n\nJonathan Gallimore and Colm Ó hÉigeartaigh discovered that Apache\nActiveMQ incorrectly handled authentication in certain functions.\nA remote attacker could possibly use this issue to perform a\nperson-in-the-middle attack. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-13920)\n\nGregor Tudan discovered that Apache ActiveMQ incorrectly handled\nLDAP authentication. A remote attacker could possibly use this issue\nto acquire unauthenticated access. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26117)\n\nIt was discovered that Apache ActiveMQ incorrectly handled\nauthentication. A remote attacker could possibly use this issue to run\narbitrary code. (CVE-2022-41678)\n\nIt was discovered that Apache ActiveMQ incorrectly handled\ndeserialization. A remote attacker could possibly use this issue to run\narbitrary shell commands. (CVE-2023-46604)\n","status":"published","published":"2024-07-23T20:39:26Z","modified":"2026-06-25T13:32:28.776549331Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}