Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
MIME-Version: 1.0
Sender: tbain98@gmail.com
In-Reply-To: <CAGeh-pG-+vdAo2TxfnJERYBB-rgcsUX=TX7L71wLGPJXq+dLmg@mail.gmail.com>
References: <CAGeh-pG-+vdAo2TxfnJERYBB-rgcsUX=TX7L71wLGPJXq+dLmg@mail.gmail.com>
Date: Tue, 24 May 2016 06:09:35 -0600
Message-ID: <CAPVVMa_M_c8_kTWep-19+kTDZ6Www-JwqHn5SYhkgvcFvDoFEA@mail.gmail.com>
Subject: =?UTF-8?Q?Re=3A_=5BANNOUNCE=5D_CVE=2D2016=2D3088=3A_ActiveMQ_Fileserver_we?=
	=?UTF-8?Q?b_application_vulnerabilities=EF=BB=BF?=
From: Tim Bain <tbain@alumni.duke.edu>
To: ActiveMQ Users <users@activemq.apache.org>
Cc: dev@activemq.apache.org,
	Apache Security Response Team <security@apache.org>, bugtraq@securityfocus.com,
	oss-security@lists.openwall.com
Content-Type: multipart/alternative; boundary=94eb2c1233342ed5650533956ed0
archived-at: Tue, 24 May 2016 12:09:41 -0000

--94eb2c1233342ed5650533956ed0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Does the range of versions specified mean that the issue is already
addressed in 5.13.3, or was its omission from the range an oversight?

Tim
On May 24, 2016 2:41 AM, "Dejan Bosanac" <dejan@nighttale.net> wrote:

> There's a security vulnerability reported against Apache
> ActiveMQ 5.13.2 and older versions.
>
> Please check the following document and see if you=E2=80=99re affected by=
 the
> issue.
>
>
> http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announc=
ement.txt
>
> Vulnerability is similar to the one reported in CVE-2015-1830 (
>
> http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announc=
ement.txt
> ).
> The fileserver web application will be removed in 5.14.0 release and user=
s
> are advised not to use it and disable it in older versions.
>
> Regards
> --
> Dejan Bosanac
> about.me/dejanb
>

--94eb2c1233342ed5650533956ed0--