{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9e00f801-a9fc-51e5-88b7-18cca4ce3ca0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3", "version": "6.1.6-tuxcare.3", "pedigree": { "ancestors": [ { "name": "activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client@6.1.6", "type": "library", "group": "org.apache.activemq", "version": "6.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-1879", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:06bb734f-a6e1-5cb0-a329-cbc1141b6e95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-1879 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2013-1879 XSS vulnerability is not present in target version 6.1.6. The fix (commit 148ca81dc) was already included in the upstream Apache ActiveMQ 6.1.6 release that TuxCare onboarded. All user-controlled fields in scheduled.jsp (cronEntry, jobId, etc.) are properly HTML-escaped using JSTL tags, preventing script injection.", "justification": "code_not_present" } }, { "id": "CVE-2013-3060", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:8ab4893f-ec3e-5116-adb7-433d716c3f5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-3060 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2013-3060: The target Apache ActiveMQ 6.1.6 is NOT AFFECTED. The vulnerability (unauthenticated web console access) was fixed in upstream commit 437ea2f6e by Claus Ibsen (AMQ-4124), which changed authenticate from \"false\" to \"true\" in jetty.xml. This fix was already present in the upstream Apache ActiveMQ 6.1.6 release that TuxCare onboarded (commit 974edcfe4). The target's jetty.xml config...", "justification": "code_not_present" } }, { "id": "CVE-2014-3576", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:bc301378-4e8e-582e-9b4c-3b7b13da5ddc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3576 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. CVE-2014-3576 is NOT present in Apache ActiveMQ 6.1.6-tuxcare.3. The vulnerable code in processControlCommand that allowed remote attackers to shutdown the broker via a \"shutdown\" control command was removed by upstream developer Timothy Bish in commit 00921f22ff9a (2014-08-13), which was already included in the upstream Apache ActiveMQ 6.1.6 release before TuxCare onboarded it. The current processControlCommand method only returns null without processing any commands.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.11.0), NVD (<= 5.10.0), Snyk (< 5.11.0; >= 5.9.0, < 5.11.0).", "justification": "code_not_present" } }, { "id": "CVE-2014-3600", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:5678a9a5-ffc3-587d-ac9e-17c340109911", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3600 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. CVE-2014-3600 affects Apache ActiveMQ 5.x before 5.10.1. The target (ActiveMQ 6.1.6) already contains the upstream XXE protection fix (commit b9696ac80) introduced by Apache developer Dejan Bosanac in August 2014. The fix configures DocumentBuilderFactory with three critical security features (disable external-general-entities, disable external-parameter-entities, disallow-doctype-decl) before parsing any XML content in XPath-based message selectors. This fix was already present in the upstream 6.1.6 release that TuxCare onboarded, verified by confirming the fix commit is an ancestor of the first TuxCare onboarding commit (974edcfe4). The vulnerable pattern (unsafe XML parsing allowing XXE attacks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5, < 5.10.1; >= 5, < 5.10.1; >= 5.0.0, < 5.10.1).", "justification": "code_not_present" } }, { "id": "CVE-2014-8110", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:bf3fe3e5-3473-53eb-a9d7-fccc25a5bbce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-8110 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2014-8110 XSS vulnerabilities are not present in ActiveMQ 6.1.6-tuxcare.3. The upstream vendor fixes from AMQ-5033 (commits 0c4790bb and 994d9b26) were included in the Apache ActiveMQ 6.1.6 release that TuxCare onboarded. All examined JSP files in the web console use proper output encoding: c:out for HTML context and c:url for URL context, preventing the injection of malicious scripts.", "justification": "code_not_present" } }, { "id": "CVE-2015-1830", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:0f3ddae1-d6ca-552b-bd41-cb688805d97b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-1830 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 The target repository (ActiveMQ 6.1.6-tuxcare.3) is NOT affected by CVE-2015-1830. The vulnerable component\u2014the activemq-fileserver webapp with its FilenameGuardFilter and RestFilter servlets that processed HTTP file upload/download requests with unsanitized path parameters\u2014was completely removed from the codebase in upstream commit 3dd86d04e (May 2016, authored by dejan@nighttale.net). This re...", "justification": "code_not_present" } }, { "id": "CVE-2015-3208", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:5d2103a3-0418-5a82-97c1-df41b0540bac", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-3208 is a false positive for org.apache.activemq:activemq-client 6.1.6-tuxcare.3." } }, { "id": "CVE-2015-5254", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:dde69cec-777f-5344-8a33-fa861c2583d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5254 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. Apache ActiveMQ 6.1.6 is NOT AFFECTED by CVE-2015-5254 (unrestricted Java deserialization in JMS ObjectMessage). The fix was introduced in upstream commit a7e2a44fe (October 2015) by Apache developer Dejan Bosanac and was already present in upstream release 6.1.6 when TuxCare onboarded it (commit 974edcfe4, September 2026). The target implements complete deserialization protection via ClassLoadingAwareObjectInputStream.checkSecurity() which validates all classes against a package whitelist (default: java.lang,org.apache.activemq,org.fusesource.hawtbuf,com.thoughtworks.xstream.mapper) before class resolution. Forbidden classes trigger ClassNotFoundException, blocking arbitrary code execution via gadget chains.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.11.3; >= 5.12.0, < 5.12.2), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0; = 5.10.1; = 5.10.2; = 5.11.0; = 5.11.1; = 5.11.2; = 5.12.0; = 5.12.1), Snyk (>= 5.9.0, < 5.10.1; < 5.11.3; >= 5.12.0, < 5.12.2).", "justification": "code_not_present" } }, { "id": "CVE-2015-7559", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:51aab1ff-d3bf-54e4-ae4a-0b3bc069252d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-7559 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2015-7559 describes a vulnerability where the Apache ActiveMQ client exposed a remote shutdown command that allowed an attacker with access to a compromised broker to terminate client processes via System.exit(0). The target repository (ActiveMQ 6.1.6-tuxcare.3) is NOT AFFECTED because the vulnerable code was already removed by upstream commit 338a74dfa, which shipped in ActiveMQ 6.1.6 befo...", "justification": "code_not_present" } }, { "id": "CVE-2016-0734", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:e85cc068-5122-592a-a72e-662acf819494", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0734 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-0734 affects Apache ActiveMQ 5.x before 5.13.2 due to missing X-Frame-Options header in the web console. The target version 6.1.6-tuxcare.3 is NOT vulnerable because the upstream Apache ActiveMQ project already fixed this issue in their 6.1.6 release (commit 24ad36778, dated 2016-02-12) before TuxCare onboarded the version. The fix configures Jetty's RewriteHandler to add \"X-FRAME-OPTI...", "justification": "code_not_present" } }, { "id": "CVE-2016-0782", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:f54423b9-06c9-577b-8a50-3ee59595d535", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0782 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-0782 is NOT AFFECTED in Apache ActiveMQ 6.1.6-tuxcare.3. The XSS vulnerability in the admin web console JSP files was fixed in upstream commit d0f5c2778 (AMQ-6146, dated 2016-01-28) by Christopher L. Shannon, which was included in the upstream ActiveMQ 6.1.6 release that TuxCare onboarded. All vulnerable JSP files (xml/queues.jsp, xml/topics.jsp, xml/subscribers.jsp, connection.jsp, me...", "justification": "code_not_present" } }, { "id": "CVE-2016-3088", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:0900c069-d4d7-5a31-ad3b-6aaae6743ab0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-3088 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. CVE-2016-3088 affects the Fileserver web application in Apache ActiveMQ, which allowed arbitrary file upload and execution via HTTP PUT/MOVE requests. The vulnerability was fixed in the upstream by completely removing the activemq-fileserver module (commit 3dd86d04e, May 2016). The target repository (version 6.1.6-tuxcare.3) does not contain the fileserver module - it was removed in the upstream release that was onboarded by TuxCare. Comprehensive searches confirm no fileserver directory, no FilenameGuardFilter.java, no RestFilter.java, and no REST endpoints handling file PUT/MOVE operations exist in the target. The vulnerable code is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.14.0), NVD (>= 5.0.0, < 5.14.0), Snyk (>= 5.0.0, < 5.13.3).", "justification": "code_not_present" } }, { "id": "CVE-2016-6810", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:2131b5ca-977f-5e0e-acf0-bd9cc8b903c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6810 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-6810 (XSS in web console) is NOT present in this target. The fix commit c1157fe1f was already included in the upstream Apache ActiveMQ 6.1.6 release. All 5 affected JSP files use the secure `` tag for HTML entity encoding instead of the vulnerable `` tag pattern, preventing XSS attacks via client IDs in href attributes.", "justification": "code_not_present" } }, { "id": "CVE-2018-11775", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:9fedc440-762d-568c-96b5-12a81db0019f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11775 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. Apache ActiveMQ 6.1.6 is NOT affected by CVE-2018-11775. The hostname verification fix was already present in the upstream 6.1.6 release that TuxCare onboarded. The fix (commit 69fad2a135689f6c31fbada1c397f2e0dfd90d3c, authored by christopher.l.shannon@gmail.com on 2018-08-21) adds TLS hostname verification by calling SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\"), which is enabled by default for client connections (verifyHostName=true). This prevents MITM attacks by validating that the server's certificate hostname matches the actual server being connected to. The vulnerable code pattern (missing hostname verification) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.6), NVD (< 5.15.6), cve.org (>= 5.0.0, <= 5.15.5), Snyk (<= 0; >= 5.0.0, < 5.15.6; >= 5.9.0, < 5.15.6; >= 5.13.0, < 5.15.6).", "justification": "code_not_present" } }, { "id": "CVE-2019-0222", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:1e938fce-5f30-58f9-912e-a01fdf72b396", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0222 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. The target Apache ActiveMQ 6.1.6 is not affected by CVE-2019-0222. The vulnerability exists in the fusesource mqtt-client library (versions \u22641.14), which ActiveMQ uses as a dependency for MQTT frame decoding. The upstream Apache ActiveMQ project fixed this by upgrading mqtt-client from 1.14 to 1.15 (commit 98b9f2e28, AMQ-7166) and later to 1.16 (commit 0b0ab2a03, AMQ-7432). Both fix commits were authored by upstream Apache developers and are ancestors of the first TuxCare commit (974edcfe4 \"Onboard version 6.1.6\"), confirming they shipped in the upstream release. The target's pom.xml shows mqtt-client-version 1.16, which includes the validation fix that throws ProtocolException on corrupt frames instead of causing OOM.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.15.9), NVD (>= 5.0.0, <= 5.15.8), cve.org (>= 5.0.0, <= 5.15.8), Snyk (<= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2023-46604", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:ea0d4e93-fdb1-5659-91f4-a0f92585851e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46604 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. CVE-2023-46604 (Remote Code Execution via OpenWire protocol) is NOT present in activemq-parent:6.1.6-tuxcare.3. The vulnerability allowed attackers to instantiate arbitrary classes on the classpath by sending malicious serialized class names in OpenWire protocol data. The fix (adding Throwable type validation before reflective instantiation) was already present in the upstream Apache ActiveMQ 6.1.6 release that TuxCare onboarded, authored by Christopher L. Shannon (christopher.l.shannon@gmail.com) in commit 3eaf3107f. The vulnerable pattern (unvalidated Class.forName with attacker-controlled input) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; >= 5.8.0, < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), NVD (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), cve.org (>= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; < 5.15.16; >= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; >= 5.8.0, < 5.15.16), Snyk (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3).", "justification": "code_not_present" } }, { "id": "CVE-2025-27533", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:140caa14-3b90-5542-a907-d6931cddfbf0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-27533 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client. not_affected \u2014 Apache ActiveMQ 6.1.6 is NOT affected by CVE-2025-27533. The vulnerability (excessive memory allocation during OpenWire command unmarshalling due to unvalidated buffer size values) was fixed in upstream commit 610cc9aca8a2 authored by Christopher L. Shannon (cshannon@apache.org). This fix was already present in the upstream 6.1.6 release when TuxCare onboarded it (first TuxCare commit 974edcfe4...", "justification": "code_not_present" } }, { "id": "CVE-2026-33227", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:8f8afd1d-61f2-53f3-b2e0-6881ea567490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33227 affects version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-39304", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:48975380-b36d-5cd1-b437-ec12d0d75626", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39304 affects version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-50734", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:f086f30f-973d-5421-a771-1dfbd3d467c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50734 affects version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-53917", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ], "bom-ref": "urn:uuid:3496d588-b821-530a-bab2-9c0f1a2a3741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53917 is fixed in version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.6-tuxcare.3" } ] }