deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 9.0.13, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 9.0.40, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 9.0.40, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-rv64-5gf8-9qq8
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 9.0.40, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

Details:
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 8.5.30, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 8.5.30, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 8.5.30, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 10.1.50, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-h468-7pvh-8vr8
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 9.0.13, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Details:
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 10.1.0-M1, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 10.1.0-M1, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-9m3c-qcxr-9x87
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 10.1.0-M1, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Open Redirect vulnerability

Details:
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-gcvm-c75m-h4p4
Package: org.apache.openmeetings:openmeetings-parent (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-598: Use of GET Request Method With Sensitive Query Strings
Vulnerable versions: >= 3.1.3, < 9.0.0
Patched in: 9.0.0

Summary: Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings 

Details:
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.

The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact


This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-78cg-fc6c-w44w
Package: org.apache.openmeetings:openmeetings-parent (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-274: Improper Handling of Insufficient Privileges
Vulnerable versions: >= 3.10, < 9.0.0
Patched in: 9.0.0

Summary: Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability

Details:
Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.

This issue affects Apache OpenMeetings: from 3.10 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-wqxq-w68r-wg85
Package: org.apache.openmeetings:openmeetings-parent (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: >= 6.1.0, < 9.0.0
Patched in: 9.0.0

Summary: Apache OpenMeetings Uses Hard-coded Cryptographic Key

Details:
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.


This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.
GitHub Security Advisory: GHSA-w35j-pv5h-q9q9
Package: org.apache.logging.log4j:log4j-layout-template-json (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 2.14.0, < 2.25.4
Patched in: 2.25.4

Summary: Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Details:
Apache Log4j's [`JsonTemplateLayout`](https://logging.apache.org/log4j/2.x/manual/json-template-layout.html), in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (`NaN`, `Infinity`, or `-Infinity`), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

An attacker can exploit this issue only if both of the following conditions are met:

  *  The application uses `JsonTemplateLayout`.
  *  The application logs a `MapMessage` containing an attacker-controlled floating-point value.

Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.
GitHub Security Advisory: GHSA-3pxv-7cmr-fjr4
Package: org.apache.logging.log4j:log4j-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 2.0-alpha1, < 2.25.4
Patched in: 2.25.4

Summary: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Details:
Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.

The impact depends on the StAX implementation in use:

  *  **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
  *  **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
GitHub Security Advisory: GHSA-5568-6qcg-g7fx
Package: org.apache.activemq:apache-activemq (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 6.0.0, < 6.2.4
Patched in: 6.2.4

Summary:  Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Details:
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.
This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.
GitHub Security Advisory: GHSA-5568-6qcg-g7fx
Package: org.apache.activemq:apache-activemq (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 5.19.4
Patched in: 5.19.4

Summary:  Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Details:
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.
This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.
GitHub Security Advisory: GHSA-5568-6qcg-g7fx
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 6.0.0, < 6.2.4
Patched in: 6.2.4

Summary:  Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Details:
Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes the broker to exhaust all its memory in the SSL engine leading to DoS.

Note: TLS versions before TLSv1.3 (such as TLSv1.2) are broken but are not vulnerable to OOM. Previous TLS versions require a full handshake renegotiation which causes a connection to hang but not OOM. This is fixed as well.
This issue affects Apache ActiveMQ Client: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.4; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.4.

Users are recommended to upgrade to version 6.2.4 or 5.19.5, which fixes the issue.