org.apache.activemq:artemis-core-client@2.0.0 vulnerabilities
latest version
2.40.0
latest non vulnerable version
first published
9 years ago
latest version published
1 months ago
licenses detected
- [1.0.0,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.activemq:artemis-core-client package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when the How to fix Insertion of Sensitive Information into Log File? Upgrade | [1.5.1,2.40.0) |
org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Denial of Service (DoS) via a crafted message sent to a Java process running an Artemis Broker. This can result in an Out-Of-Memory crash. ###PoC
NOTE: This vulnerability has also been identified as: CVE-2021-4040 How to fix Denial of Service (DoS)? Upgrade | [,2.19.1) |
org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Denial of Service (DoS) via a crafted message sent to a Java process running an Artemis Broker. This can result in an Out-Of-Memory crash. ###PoC
NOTE: This vulnerability has also been identified as: CVE-2022-23913 How to fix Denial of Service (DoS)? Upgrade | [,2.19.1) |
org.apache.activemq:artemis-core-client is a High-performance, non-blocking architecture for the next generation of event-driven messaging applications. Affected versions of this package are vulnerable to Denial of Service (DoS). If an Apache Artemis broker is configured with discovery enabled (either UDP or JGroups), on receiving of a packet over a discovery endpoint, Apache Artemis will attempt to decode the packet and as part of it an encoded simple string. The first four bytes of the encoded simple string represent it's length. During the decoding process Apache Artemis will create a byte array of the same length. It is possible therefore to send a manipulated packet to Apache Artemis with a very large integer in the first four bytes of the simple string encoding. Upon receiving the packet the broker will attempt to allocate a byte array of this large size. This could result in heap memory exhaustion, full GC or in the worst case an unrecoverable OutOfMemoryError, resulting in loss of service. How to fix Denial of Service (DoS)? Upgrade | [2.0.0,2.4.0)[1.0.0,1.5.6) |