[oss-security] [ANNOUNCE] CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification

[Christopher Shannon]

The following security vulnerability was reported against Apache
ActiveMQ 5.15.5 and older versions.

Please check the following document and see if you’re affected by the issue.

http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt

Apache ActiveMQ 5.15.6 has been released with appropriate fixes and is
available for upgrade.

[Christopher Shannon]

I just realized I had a typo in the announcement, the versions
affected should be:
Apache ActiveMQ 5.0.0 - 5.15.5

The file will be updated shortly.
On Mon, Sep 10, 2018 at 2:40 PM Christopher Shannon

Post by Christopher Shannon
The following security vulnerability was reported against Apache
ActiveMQ 5.15.5 and older versions.
Please check the following document and see if you’re affected by the issue.
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt
Apache ActiveMQ 5.15.6 has been released with appropriate fixes and is
available for upgrade.

[Solar Designer]

Christopher,

Please check the following document and see if you're affected by the issue.
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt

Thank you for bringing this to oss-security. However, please be aware
that including essential information only by reference is against list
content guidelines here:

https://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines

which include:

"At least the most essential part of your message (e.g., vulnerability
detail and/or exploit) should be directly included in the message itself
(and in plain text), rather than only included by reference to an
external resource. Posting links to relevant external resources as well
is acceptable, but posting only links is not. Your message should
remain valuable even with all of the external resources gone."

To correct this, I've attached the entire text file from the URL above,
with the typo corrected as you mentioned in your follow-up message.

Alexander