Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
MIME-Version: 1.0
Sender: chubrilo@gmail.com
Date: Tue, 24 May 2016 14:17:48 +0200
Message-ID: <CAGeh-pFfPXUX8XpUAJt5n6=qvoAr82ubN97BxE4a44o79tCudg@mail.gmail.com>
Subject: Re: [ANNOUNCE] CVE-2016-3088: ActiveMQ Fileserver web application vulnerabilities
From: Dejan Bosanac <dejan@nighttale.net>
To: "users@activemq.apache.org" <users@activemq.apache.org>
Cc: "dev@activemq.apache.org" <dev@activemq.apache.org>,
	Apache Security Response Team <security@apache.org>, bugtraq@securityfocus.com,
	oss-security@lists.openwall.com
Content-Type: multipart/alternative; boundary=94eb2c047c5893a2570533958b9f
archived-at: Tue, 24 May 2016 12:17:55 -0000

--94eb2c047c5893a2570533958b9f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Tim,

it=E2=80=99s an omission. The feature will be completely removed with 5.14.=
0 and
it=E2=80=99s been disabled by default since 5.12.0, so 5.13.x broker that h=
aven=E2=80=99t
this feature turn on explicitly are not vulnerable.

I=E2=80=99ll fix the announcement now to say 5.13.x so it=E2=80=99s future =
proof in case of
new 5.13 branch releases

Regards
--
Dejan Bosanac
about.me/dejanb

On Tue, May 24, 2016 at 2:09 PM, Tim Bain <tbain@alumni.duke.edu> wrote:

> Does the range of versions specified mean that the issue is already
> addressed in 5.13.3, or was its omission from the range an oversight?
>
> Tim
> On May 24, 2016 2:41 AM, "Dejan Bosanac" <dejan@nighttale.net> wrote:
>
> > There's a security vulnerability reported against Apache
> > ActiveMQ 5.13.2 and older versions.
> >
> > Please check the following document and see if you=E2=80=99re affected =
by the
> > issue.
> >
> >
> >
> http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announc=
ement.txt
> >
> > Vulnerability is similar to the one reported in CVE-2015-1830 (
> >
> >
> http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announc=
ement.txt
> > ).
> > The fileserver web application will be removed in 5.14.0 release and
> users
> > are advised not to use it and disable it in older versions.
> >
> > Regards
> > --
> > Dejan Bosanac
> > about.me/dejanb
> >
>

--94eb2c047c5893a2570533958b9f--