{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a5fbf6c6-3c4a-5eef-8c7b-c0cc476cd28c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "apache-activemq", "purl": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2", "version": "6.1.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "apache-activemq", "purl": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6", "type": "library", "group": "org.apache.activemq", "version": "6.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-6551", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:5563f656-ab36-5972-b9d4-2463a4142316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2012-6551 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq. not_affected \u2014 CVE-2012-6551 affects Apache ActiveMQ before 5.8.0 where a sample web application is enabled by default, allowing DoS attacks via HTTP requests. The target (version 6.1.6-tuxcare.3) contains upstream vendor fixes from commits 437ea2f6e, 22bc55b94, and ced33d255 that remove the demo webapp from default configuration. These fixes shipped in the upstream 6.1.6 release prior to TuxCare onboarding (...", "justification": "code_not_present" } }, { "id": "CVE-2022-41678", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:8339fc3a-d2ff-5436-9a2b-df895e3146eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41678 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq. CVE-2022-41678 is not present in this ActiveMQ version. The vulnerability required unrestricted Jolokia JMX exec operations to invoke jdk.management.jfr.FlightRecorderMXBeanImpl methods for arbitrary file writes. The upstream vendor fix (commit 6120169e5 by Christopher L. Shannon) shipped in ActiveMQ 6.1.6 restricts Jolokia to read-only commands and explicitly denies FlightRecorder MBean access. This fix was included in the upstream release that TuxCare onboarded, making it an upstream-provided mitigation rather than a TuxCare backport. The jolokia-access.xml configuration is properly loaded at runtime via servlet policyLocation parameter.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.16.6; >= 5.17.0, < 5.17.4), NVD (< 5.16.6; >= 5.17.0, < 5.17.4), cve.org (< 5.16.6; >= 5.17.0, < 5.17.4), Snyk (< 5.16.6; >= 5.17.0, < 5.17.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-32114", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c27ffa1e-b17c-5dc5-9b9b-bcfba68bfff6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-32114 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq. not_affected \u2014 CVE-2024-32114 affects Apache ActiveMQ 6.x versions before 6.1.2, where the default jetty.xml configuration did not require authentication for the /api web context (Jolokia JMX REST API and Message REST API). The target version 6.1.6 is NOT affected because the upstream fix (commit 09e3251c8 by cshannon@apache.org, April 10, 2024) was already present in the upstream 6.1.6 release. The fix sets ...", "justification": "code_not_present" } }, { "id": "CVE-2025-66168", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:117cf626-4833-5844-b376-507ed6d001c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-66168 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-108946", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ee7328ee-43b8-5984-a5c9-6e1919b54d07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-108946 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-111821", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:58d02d75-5546-5509-9291-8adad836aea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111821 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-111822", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:1d9464ce-1ae4-534c-b2ac-b64a46eebf3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-111822 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-39304", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:654d1436-0fc7-5240-a352-880bb4b31157", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39304 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-40046", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:3e0f1a8a-88a7-529e-81da-e0702b5031ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40046 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-40466", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:4152211e-c627-593e-8295-49dd898289ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40466 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-41043", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:be21f16d-51cf-5f0c-b3b8-f736c2349e31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41043 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-41044", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:b55abfab-0487-5d3c-9734-a58c24383035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41044 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-42253", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:a61bb708-bb71-552d-baa8-4543d6e3dbdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42253 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-42588", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2d84f3e2-ba97-5a67-b35d-5d64f7d00b26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42588 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-45505", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:14b3476e-708d-5598-8cfa-26f5e93e3e0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45505 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-46605", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:aa8b77fa-3bc6-5599-b3ea-9655ef8427ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-46605 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-49157", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c4e95e58-0f94-5939-9b13-822a3a5aa2a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49157 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-49270", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:99191fff-5987-5207-b70d-a78d9296d669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49270 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-49432", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:238796f8-e6f6-57b4-a83a-d0f001f45d67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49432 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-49434", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:4e29322e-24c5-5b86-bdf3-7b4a5c52d7d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49434 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-49877", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ad544ad4-7e60-596b-bfbd-449d4d756f5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49877 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-50734", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ad0ef274-537e-5a31-a796-d895899dc6f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50734 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-50750", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:aef05c83-eec1-5c81-b69a-7d18aabe0e66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50750 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-52760", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:43366a5a-c640-574d-b3fe-505c249ff5eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-52760 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-53916", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2ecbd82b-97ed-5dbe-8e20-8c19b59efa1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53916 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-53917", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:92bee70d-e27e-58f0-b830-de5c69771442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53917 is fixed in version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-54475", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:38fdc8b4-212e-522d-94fb-a11b1243c74a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54475 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-59878", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:07018ac9-3c8f-59f2-90da-8e3161a7ddf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59878 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-61487", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:eb70973f-0c7d-5e2f-a62e-0d724e3d2744", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-61487 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } }, { "id": "CVE-2026-74761", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ], "bom-ref": "urn:uuid:20dc7d78-9af4-52bf-9b7e-7dd20bc14d27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-74761 affects version 6.1.6-tuxcare.2 of org.apache.activemq:apache-activemq." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/apache-activemq@6.1.6-tuxcare.2" } ] }