{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:780dc242-787b-5b96-a79f-d607702ff65e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2", "version": "6.1.8-tuxcare.2", "pedigree": { "ancestors": [ { "name": "activemq-client", "purl": "pkg:maven/org.apache.activemq/activemq-client@6.1.8", "type": "library", "group": "org.apache.activemq", "version": "6.1.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-1879", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:2538ee8c-e739-559a-a599-819e5ca2ad27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-1879 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 The target ActiveMQ 6.1.8 is not affected by CVE-2013-1879. The XSS vulnerability in scheduled.jsp was already fixed in the upstream Apache ActiveMQ release that TuxCare onboarded. The fix (commit 148ca81dc by Apache committer dejanb@apache.org) wraps all JSP EL expressions with tags to HTML-escape output, preventing script injection via scheduled job data including cron expressions.", "justification": "code_not_present" } }, { "id": "CVE-2013-3060", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:57bd9131-4d65-51ad-af15-ede768afa822", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-3060 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2013-3060 affects Apache ActiveMQ before version 5.8.0 due to disabled authentication on the web console. The target repository is ActiveMQ version 6.1.8, which is much newer than the affected versions. The upstream fix (commit 437ea2f6e58d from November 2012) that enables authentication by setting authenticate=\"true\" in jetty.xml was already present in the upstream release that TuxCare onb...", "justification": "code_not_present" } }, { "id": "CVE-2014-3576", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:84d62e07-574f-5cd9-87e1-a92758944ba4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3576 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2014-3576 is not present in the target. The vulnerability allowed remote attackers to shut down the Apache ActiveMQ broker by sending a ControlCommand with \"shutdown\" directive, which would trigger System.exit(0) in the processControlCommand method. This vulnerable code pattern was removed by upstream commit 00921f22f authored by Timothy Bish on August 13, 2014. The fix was already present in the upstream ActiveMQ release when TuxCare onboarded version 6.1.8, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.11.0), NVD (<= 5.10.0), Snyk (< 5.11.0; >= 5.9.0, < 5.11.0).", "justification": "code_not_present" } }, { "id": "CVE-2014-3600", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:e14b107b-8703-5bdf-bc9b-2f840d85467d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3600 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2014-3600 (XXE vulnerability in XPath-based message selectors) is NOT present in Apache ActiveMQ 6.1.8-tuxcare.2. The upstream fix (commit b9696ac80 from August 2014) was already included in ActiveMQ 6.1.8 before TuxCare onboarded this version. The fix configures DocumentBuilderFactory with XXE-protection features: disables external-general-entities, external-parameter-entities, and disallows DOCTYPE declarations. The secured DocumentBuilder is used by both JAXPXPathEvaluator and XalanXPathEvaluator when parsing XML messages, preventing external entity resolution attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5, < 5.10.1; >= 5, < 5.10.1; >= 5.0.0, < 5.10.1).", "justification": "code_not_present" } }, { "id": "CVE-2014-8110", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:01bf0e56-f121-5145-bdd0-f2ee367a9a1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-8110 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2014-8110 describes multiple XSS vulnerabilities in the Apache ActiveMQ web console that allowed attackers to inject arbitrary HTML/JavaScript via unescaped user input. The target (ActiveMQ 6.1.8-tuxcare.2) contains comprehensive XSS fixes from upstream commit 0c4790bb9 (AMQ-5033), which systematically added HTML entity encoding via tags and URL encoding via / tags a...", "justification": "code_not_present" } }, { "id": "CVE-2015-1830", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:b0a7cba0-3c9b-5a2f-b4f1-db99aa52d219", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-1830 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2015-1830 affects the activemq-fileserver HTTP web application module which provided blob message upload/download functionality. This module was completely removed by upstream Apache in commit 3dd86d04e (May 3, 2016) during ActiveMQ 5.14.0 development, before version 6.0.0 was released. Version 6.1.8 never contained the fileserver module. The vulnerable code path (HTTP servlet receiving fil...", "justification": "code_not_present" } }, { "id": "CVE-2015-3208", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:d702a6bb-b35c-51b3-9d5d-d28702458998", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2015-3208 is a false positive for org.apache.activemq:activemq-client 6.1.8-tuxcare.2." } }, { "id": "CVE-2015-5254", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:95a6f1f9-214f-5ca2-9899-77cb176bcd5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5254 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2015-5254 affects Apache ActiveMQ versions before 5.13.0 due to unrestricted Java deserialization in JMS ObjectMessages. The target (ActiveMQ 6.1.8-tuxcare.2) is NOT AFFECTED because the upstream vendor fix (AMQ-6013) was already present in the upstream ActiveMQ 6.1.8 release that TuxCare onboarded. The fix adds package whitelist validation via ClassLoadingAwareObjectInputStream.checkSecurity() that blocks deserialization of non-whitelisted classes, preventing arbitrary code execution. Verification confirms the fix is comprehensively applied across all deserialization paths (ObjectMessage, XStream) with no bypasses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.11.3; >= 5.12.0, < 5.12.2), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0; = 5.10.1; = 5.10.2; = 5.11.0; = 5.11.1; = 5.11.2; = 5.12.0; = 5.12.1), Snyk (>= 5.9.0, < 5.10.1; < 5.11.3; >= 5.12.0, < 5.12.2).", "justification": "code_not_present" } }, { "id": "CVE-2015-7559", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:49fb5538-aa18-5922-b5b6-7ed8a6353401", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-7559 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2015-7559 is NOT present in the target repository. The vulnerability allowed a compromised broker to send a ControlCommand with \"shutdown\" text, causing the client to execute System.exit(0). The fix (commit 338a74dfa) completely removed the dangerous onControlCommand method and its invocation from ActiveMQConnection. This fix was authored by upstream Apache ActiveMQ developer Dejan Bosanac ...", "justification": "code_not_present" } }, { "id": "CVE-2016-0734", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:34c5cb2e-0e2a-54d2-b168-2331b7d64bf5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0734 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-0734 is not present in Apache ActiveMQ 6.1.8. The vulnerability (missing X-Frame-Options header in the web console) was fixed by upstream Apache in commit 24ad36778 (AMQ-6170, Feb 2016) which added Jetty RewriteHandler configuration to send X-FRAME-OPTIONS: SAMEORIGIN on all responses. This fix was already present in the upstream release 6.1.8 that TuxCare onboarded, as confirmed by gi...", "justification": "code_not_present" } }, { "id": "CVE-2016-0782", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:a1ae9b59-9738-5364-852c-dae17eabe8ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0782 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-0782 XSS vulnerability is NOT present in target. All fixes from upstream commit d0f5c277 (Jan 2016) are present: JSP files wrap user-controlled names in <c:out> tags for HTML encoding (queues.jsp:22,28-29; topics.jsp:22; connection.jsp:108,111; message.jsp:143,166; subscribers.jsp:22-48), and Jolokia hardening is applied (allowErrorDetails=false, discovery disabled in web.xml:69-...", "justification": "code_not_present" } }, { "id": "CVE-2016-3088", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:dc331eaf-30ac-5f4d-9c46-39f6d8f0150c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-3088 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2016-3088 affects the Fileserver web application in Apache ActiveMQ 5.x before 5.14.0, allowing arbitrary file upload via directory traversal. The target (ActiveMQ 6.1.8-tuxcare.2) is NOT AFFECTED because the entire activemq-fileserver module was removed by upstream in commit 3dd86d04e (May 2016), which was already present in the upstream 6.1.8 release when TuxCare onboarded it. The vulnerable FilenameGuardFilter and RestFilter classes do not exist, the activemq-fileserver directory is absent, and jetty.xml contains no fileserver webapp configuration. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.14.0), NVD (>= 5.0.0, < 5.14.0), Snyk (>= 5.0.0, < 5.13.3).", "justification": "code_not_present" } }, { "id": "CVE-2016-6810", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ebdedbae-b6c8-5925-a7e5-45f19cb94287", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6810 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2016-6810 is not present in ActiveMQ 6.1.8. The XSS vulnerability involved improper output escaping of client IDs in 5 JSP files of the web console. All 5 files (queueConsumers.jsp, queueProducers.jsp, subscribers.jsp, topicProducers.jsp, topicSubscribers.jsp) use the fixed code pattern with <c:out> tags for HTML escaping, not the vulnerable <c:url> pattern. The fix (commit c115...", "justification": "code_not_present" } }, { "id": "CVE-2018-11775", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:9b57082a-e70d-5216-991f-e41aadbed1fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11775 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2018-11775 is NOT present in ActiveMQ 6.1.8. The vulnerability required TLS hostname verification to be missing in the ActiveMQ Client, allowing MITM attacks. The fix (enabling hostname verification by default on client SSL connections via SSLParameters.setEndpointIdentificationAlgorithm(\"HTTPS\")) was already present in the upstream ActiveMQ 6.1.8 release when TuxCare onboarded it. The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.6), NVD (< 5.15.6), cve.org (>= 5.0.0, <= 5.15.5), Snyk (<= 0; >= 5.0.0, < 5.15.6; >= 5.9.0, < 5.15.6; >= 5.13.0, < 5.15.6).", "justification": "code_not_present" } }, { "id": "CVE-2019-0222", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:14d040bf-5a8a-5c6d-a703-367bd72bb753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0222 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. CVE-2019-0222 is not present in Apache ActiveMQ 6.1.8. The vulnerability exists in the mqtt-client dependency library (org.fusesource.mqtt-client) versions prior to 1.15, where unmarshalling corrupt MQTT frames could cause Out of Memory exceptions. The target repository has mqtt-client version 1.16 (pom.xml:88), which contains the fix. The upgrade from vulnerable version 1.14 to fixed version 1.15 was already included in the upstream Apache ActiveMQ 6.1.8 release that TuxCare onboarded. The fix commit (98b9f2e28) authored by upstream developer dejan@nighttale.net is an ancestor of the first TuxCare commit (309e112aa). The test case verifying corrupt frame handling (MQTTCodecTest.java:260-280) is present in the target, confirming the fix is in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.15.9), NVD (>= 5.0.0, <= 5.15.8), cve.org (>= 5.0.0, <= 5.15.8), Snyk (<= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2023-46604", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:0ddc40f5-576c-5ce6-8f37-f18e83b58bb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46604 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. The target repository (Apache ActiveMQ 6.1.8-tuxcare.2) is NOT vulnerable to CVE-2023-46604. The upstream Apache fix (commit 3eaf3107f by Christopher L. Shannon) was already present in the ActiveMQ 6.1.8 release that TuxCare onboarded. The fix adds OpenWireUtil.validateIsThrowable() validation in BaseDataStreamMarshaller.createThrowable() across all OpenWire protocol versions (v1-v12), preventing arbitrary class instantiation by validating that deserialized class names are assignable to Throwable before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; >= 5.8.0, < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), NVD (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), cve.org (>= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; < 5.15.16; >= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; >= 5.8.0, < 5.15.16), Snyk (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3).", "justification": "code_not_present" } }, { "id": "CVE-2025-27533", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:e08e9916-1953-5eca-8325-21148257587c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-27533 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client. not_affected \u2014 CVE-2025-27533 (unvalidated buffer sizes during OpenWire unmarshalling) is NOT present in ActiveMQ 6.1.8-tuxcare.2. The fix was authored by Apache upstream (Christopher L. Shannon, cshannon@apache.org) and shipped in ActiveMQ 6.1.8 upstream release, which TuxCare then onboarded. The complete defense is present: validateBufferSize() validates size values before allocation, MarshallingContext tra...", "justification": "code_not_present" } }, { "id": "CVE-2026-33227", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:1f81f64a-a08c-5f2d-ace7-02f6f733e478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33227 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-39304", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:80ac25b8-f772-53c4-a115-0002b0f6a490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39304 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-50734", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:32268838-fed0-5fb5-b473-e757458dfbf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50734 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client." } }, { "id": "CVE-2026-53917", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ], "bom-ref": "urn:uuid:11794724-6773-51d8-9083-f399701f3637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53917 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-client@6.1.8-tuxcare.2" } ] }