{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0a447627-f04c-50ef-9f1d-6e6a983a52b4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "activemq-parent", "purl": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1", "version": "6.1.6-tuxcare.1", "pedigree": { "ancestors": [ { "name": "activemq-parent", "purl": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6", "type": "library", "group": "org.apache.activemq", "version": "6.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-0684", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:95d8cf15-1d8c-5f40-a30f-ffe4fc7c0495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2010-0684 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2010-0684 (XSS in createDestination.action via JMSDestination parameter) is NOT present in ActiveMQ 6.1.6. The vulnerability was fixed in Apache ActiveMQ 5.3.1 (February 2010) by upstream commit fed39c3619825bd92990cf1aa7a4e85119e00a6e. The target version 6.1.6 was released much later and already contains the complete XSS fix: all user-supplied parameters are HTML-escaped using StringEscape...", "justification": "code_not_present" } }, { "id": "CVE-2010-1244", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:2e0c10bf-ba78-5833-b04a-31b3ccefd039", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2010-1244 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2010-1244 (CSRF vulnerability in createDestination.action) is NOT present in ActiveMQ 6.1.6. The upstream Apache vendor fixed this vulnerability in commit 9dc43f3ff (Feb 2010) by adding two defensive layers: (1) HTTP method restriction forcing POST-only for state-changing controllers, and (2) CSRF token validation using session-scoped UUID secrets. This fix was already part of the upstream ...", "justification": "code_not_present" } }, { "id": "CVE-2017-15709", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:d755d777-394f-56c5-89cc-49f1fa81acfe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-15709 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2017-15709 affects ActiveMQ 5.14.0-5.15.2, where the OpenWire protocol client unconditionally exposed detailed platform information (JVM version, OS name, OS version, OS architecture) during connection handshake. The target repository (ActiveMQ 6.1.6) already contains the upstream fix (commit 5fa0bbd5, AMQ-6871) that defaults to sending a generic 'Java' string instead. This fix was shipped ...", "justification": "code_not_present" } }, { "id": "CVE-2020-11998", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:ce8add3c-95e8-5cc7-9623-36d2c8dfe251", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-11998 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2020-11998 describes a regression where an empty HashMap was passed to RMIConnectorServer instead of the configured authentication credentials environment map. The vulnerable code pattern (creating and passing an empty HashMap) is NOT present in Apache ActiveMQ 6.1.6. The fix (commit aa8900ca7 by coheigea@apache.org) was already included in the upstream Apache ActiveMQ 6.1.6 release that Tu...", "justification": "code_not_present" } }, { "id": "CVE-2020-13920", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:51e2ea91-5b2c-5fc8-add9-ff5e61586d30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13920 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 Target is not affected by CVE-2020-13920. The vulnerability (unauthenticated RMI registry rebind allowing man-in-the-middle credential interception) was fixed in upstream Apache ActiveMQ and shipped in release 6.1.6 before TuxCare onboarded it. The fix commit f1d010083 (author: jon@jrg.me.uk, committer: jbonofre@apache.org) implements a protected RMI registry using a Proxy pattern that blocks b...", "justification": "code_not_present" } }, { "id": "CVE-2020-13947", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:0efa1c2c-48cf-5b6e-88ad-692ecbd6e7d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13947 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. not_affected \u2014 CVE-2020-13947 is an XSS vulnerability in ActiveMQ's web console message.jsp page where URL parameters were concatenated without encoding. The target repository (ActiveMQ 6.1.6-tuxcare.3) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboarded. Commit 4450c17c1 by artnaseef@apache.org (dated 2020-08-31) added proper URL encoding via encodeURIComponent(...", "justification": "code_not_present" } }, { "id": "CVE-2021-26117", "affects": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ], "bom-ref": "urn:uuid:ba4d83fc-0598-503e-9e2d-268f42556324", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-26117 does not affect version 6.1.6-tuxcare.1 of org.apache.activemq:activemq-parent. The target repository (Apache ActiveMQ 6.1.6-tuxcare.3) is NOT AFFECTED by CVE-2021-26117. The vulnerability pattern has been removed by an upstream vendor fix (commit 73e291693 \"AMQ-8035\" by gary.tully@gmail.com) that was already present in the upstream release 6.1.6 before TuxCare onboarded it. The fix explicitly sets SECURITY_AUTHENTICATION to \"simple\" before credential binding at line 433 of LDAPLoginModule.java, ensuring passwords are validated even when LDAP is configured with anonymous server access, then restores the original authentication mode at line 458. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.16.0, < 5.16.1; < 5.15.14), NVD (>= 5.15.0, < 5.15.14; >= 5.16.0, < 5.16.1), cve.org (< 2.16.0; < 5.15.14), Snyk (>= 5.16.0, < 5.16.1; < 5.15.14).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/activemq-parent@6.1.6-tuxcare.1" } ] }