CVE-2021-26117— Apache ActiveMQ 授权问题漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

Apache Software Foundation Apache ActiveMQ

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。 Apache ActiveMQ LDAP login module 存在授权问题漏洞，该漏洞源于匿名上下文用于验证错误的有效用户密码，导致不检查密码。以下产品及版本受到影响：Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16

CVE-2021-26117 影响 Apache Software Foundation Apache ActiveMQ。利用概率较高，应尽快评估。Apache ActiveMQ是美国阿帕奇（Apache）基金会的一套开源的消息中间件，它支持Java消息服务、集群、Spring Framework等。 Apache ActiveMQ LDAP login module 存在授权问题漏洞，该漏洞源于匿名上下文用于验证错误的有效用户密码，导致不检查密码。以下产品及版本受到影响：Apache ActiveMQ CVE-2021-26117 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2021-26117

一、 漏洞 CVE-2021-26117 基础信息

受影响产品

二、漏洞 CVE-2021-26117 的公开POC

三、漏洞 CVE-2021-26117 的情报信息

CVE-2021-26117 厂商安全公告 (4)

• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://security.netapp.com/advisory/ntap-20210304-0008/
• https://www.oracle.com//security-alerts/cpujul2021.html

CVE-2021-26117 邮件列表归档 (17)

• https://mail-archives.apache.org/mod_mbox/activemq-users/202101.mbox/%3cCAH+vQmMeUEiKN4wYX9nLBbqmFZFPXqajNvBKmzb2V8QZANcSTA%40mail.gmail.com%3e
• https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html mailing-list
• https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html mailing-list
• https://lists.apache.org/thread.html/r519bfafd67091d0b91243efcb1c49b1eea27321355ba5594f679277d%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r110cacfa754471361234965ffe851a046e302ff2693b055f49f47b02%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/rd05b1c9d61dbd220664d559aa0e2b55e5830f006a09e82057f3f7863%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/raea451de09baed76950d6a60cc4bb1b74476c505e03205a3c68c9808%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r22cdc0fb45e223ac92bc2ceff7af92f1193dfc614c8b248534456229%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/ra255ddfc8b613b80e9fa22ff3e106168b245f38a22316bfb54d21159%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/rd75600cee29cb248d548edcf6338fe296466d63a69e2ed0afc439ec7%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r3341d96d8f956e878fb7b463b08d57ca1d58fec9c970aee929b58e0d%40%3Cissues.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/rffa5cd05d01c4c9853b17f3004d80ea6eb8856c422a8545c5f79b1a6%40%3Ccommits.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/re1b98da90a5f2e1c2e2d50e31c12e2578d61fe01c0737f9d0bd8de99%40%3Cannounce.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/rec93794f8aeddf8a5f1a643d264b4e66b933f06fd72a38f31448f0ac%40%3Cgitbox.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r5899ece90bcae5805ad6142fdb05c58595cff19cb2e98cc58a91f55b%40%3Cgitbox.activemq.apache.org%3E mailing-list
• https://lists.apache.org/thread.html/r70389648227317bdadcdecbd9f238571a6047469d156bd72bb0ca2f7%40%3Cgitbox.activemq.apache.org%3E mailing-list

• https://www.cve.org/CVERecord?id=CVE-2021-26117

IV. Related Vulnerabilities

V. Comments for CVE-2021-26117