Is CVE-2021-26118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-26118 being exploited in the wild.

How severe is CVE-2021-26118?

High severity, with a CVSS score of 7.5, published 16 June 2021.

Which products and versions are affected?

Apache Activemq Artemis < 2.16.0; org.apache.activemq:artemis-openwire-protocol (Maven) < 2.16.0, ECOSYSTEM:introduced=0,fixed=2.16.0.

Is there a fix for CVE-2021-26118?

Yes. org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-26118 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-26118?

Check whether you run Apache Activemq Artemis or org.apache.activemq:artemis-openwire-protocol (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-26118: Apache ActiveMQ Artemis improper access control in OpenWire protocol

Q: Is there a fix for CVE-2021-26118?

Yes. org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2021-26118 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2021-26118?

Check whether you run Apache Activemq Artemis or org.apache.activemq:artemis-openwire-protocol (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-26118 · Severity: high · CVSS 7.5 · Published 2021-06-16

Apache ActiveMQ Artemis, a popular message broker used for communication between different software applications, contains a security flaw in how it handles certain internal notification messages. An attacker could exploit this to bypass security policies and send unauthorized messages, potentially disrupting operations or manipulating data flow. This issue affects systems using the OpenWire protocol and has been resolved in version 2.16.0.

Technologies: Apache Activemq Artemis. Vendors: Apache, Maven.

Quick answers

Is CVE-2021-26118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-26118 being exploited in the wild.
How severe is CVE-2021-26118?: High severity, with a CVSS score of 7.5, published 16 June 2021.
Which products and versions are affected?: Apache Activemq Artemis < 2.16.0; org.apache.activemq:artemis-openwire-protocol (Maven) < 2.16.0, ECOSYSTEM:introduced=0,fixed=2.16.0.
Is there a fix for CVE-2021-26118?: Yes. org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-26118 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-26118?: Check whether you run Apache Activemq Artemis or org.apache.activemq:artemis-openwire-protocol (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.activemq:artemis-openwire-protocol (Maven): upgrade to 2.16.0 or later

# set org.apache.activemq:artemis-openwire-protocol to 2.16.0 in your pom.xml or build.gradle

Technical details

A vulnerability in the OpenWire protocol head of Apache ActiveMQ Artemis (specifically identified in version 2.15.0) allows for the production of advisory messages without proper access control. The root cause is a failure to apply policy-based access control to these specific message types, which effectively allows an attacker to bypass security restrictions for the entire session. This is a network-reachable vulnerability that requires no authentication or user interaction. An attacker can exploit this to inject unauthorized advisory messages, impacting the integrity of the messaging system. The issue is addressed in version 2.16.0.

Affected products

Apache ActiveMQ Artemis < 2.16.0

Identifiers

CVE-2021-26118
GHSA-q7fr-vqhq-v5xr

Timeline

2021-01-27: disclosed: NVD published date
2021-06-16: advisory: GitHub Advisory published
2020-10-29: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.