Description
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Artemis
Default version status: unaffected
2.50.0 to ≤ 2.56.0affected
pkg:maven/org.apache.artemis/artemis-openwire-protocolApache Software Foundation Apache Artemis
Default version status: unaffected
2.50.0 to ≤ 2.56.0affected
pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocolApache Software Foundation Apache ActiveMQ Artemis
Default version status: unaffected
1.0.0 to ≤ 2.44.0affected
pkg:maven/org.apache.activemq/artemis-openwire-protocolApache Software Foundation Apache ActiveMQ Artemis
Default version status: unaffected
2.32.0 to ≤ 2.44.0affected
pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol