Your message dated Tue, 18 Sep 2018 19:49:15 +0000
with message-id <[email protected]>
and subject line Bug#908950: fixed in activemq 5.15.6-1
has caused the Debian Bug report #908950,
regarding activemq: CVE-2018-11775: ActiveMQ Client: Missing TLS Hostname
Verification
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
908950: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908950
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: activemq
Version: 5.14.3-3
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for activemq.
CVE-2018-11775[0]:
| TLS hostname verification when using the Apache ActiveMQ Client before
| 5.15.6 was missing which could make the client vulnerable to a MITM
| attack between a Java application using the ActiveMQ client and the
| ActiveMQ server. This is now enabled by default.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-11775
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11775
[1]
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: activemq
Source-Version: 5.15.6-1
We believe that the bug you reported is fixed in the latest version of
activemq, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Markus Koschany <[email protected]> (supplier of updated activemq package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 18 Sep 2018 20:56:32 +0200
Source: activemq
Binary: libactivemq-java activemq
Architecture: source
Version: 5.15.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Markus Koschany <[email protected]>
Description:
activemq - Java message broker - server
libactivemq-java - Java message broker core libraries
Closes: 907688 908950
Changes:
activemq (5.15.6-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 5.15.6.
- Fix CVE-2018-11775: ActiveMQ Client: Missing TLS Hostname Verification.
Thanks to Salvatore Bonaccorso for the report. (Closes: #908950)
* Declare compliance with Debian Policy 4.2.1.
* Add a new patch and fix the current FTBFS because debian/maven.rules does
not work as expected with maven plugins. (Closes: #907688)
Checksums-Sha1:
edc898631d75c869db7b632337145ff463f6901a 3552 activemq_5.15.6-1.dsc
b54a13c96a880f38d2f017a8c11635c446b6dfd8 2665256 activemq_5.15.6.orig.tar.xz
24f0ffc9a94d336a5e3061e1cda3c861d1f0af91 16216 activemq_5.15.6-1.debian.tar.xz
4a191a8229cddf77765a03d05e7e724304580d68 17879
activemq_5.15.6-1_amd64.buildinfo
Checksums-Sha256:
cba33c810a38897a620108e2a2e0126724e8a194057cfead613864fed6f902d0 3552
activemq_5.15.6-1.dsc
a2e09e93c84056a21a3406d480898fc6902341c8913c799b073340e69a89c96e 2665256
activemq_5.15.6.orig.tar.xz
b6b4e5f6c367522f0ba349d1bd76e75c38b1d01f30655a1d5cc881e8eb75ae9b 16216
activemq_5.15.6-1.debian.tar.xz
8e86ee0b450cf8319dfb10cf674a8e45c27ca398c8c868824049efd93e5ea810 17879
activemq_5.15.6-1_amd64.buildinfo
Files:
a907557cf9c13afec1ed08a183c73536 3552 java optional activemq_5.15.6-1.dsc
ef5a41a9e4db217ee18f05e5851f84d7 2665256 java optional
activemq_5.15.6.orig.tar.xz
3a05d27a46e5d8efc234be4222ef4b02 16216 java optional
activemq_5.15.6-1.debian.tar.xz
5bef7fc4e98af8feb2fa2478b3a80cf1 17879 java optional
activemq_5.15.6-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAluhUH1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HktGIQAJepq9ikHhVvwmYZT8RP5obkOS8AtlmgOz/q
4lS14GGob71UBvF4saEqGYfU0pPbWuVsrMX/mheT1ib0IgxMlRNTgqNikQPafIyP
JP6qHk0kKf0/MntWkNywc1B/RiQFILZS2auSBsSfz9P+VYpx3xVKOqyo2wmDvrqY
DRPk2KuTCQbe9GNj47DkodD4INQujjzDBl3eNxOfEL3grvInqLG9SR5GYpvvd3GS
QTUcxD9qp7JLnnO6Tjiz5ew8CfNmvG0zxyFUU0vkuN3lqAFaJD8ddi2k6fSRXQN6
xKhp44KjBA53BcHzsAfhYsWgyoNJ25iboiW3/+e1RZvhuHT2UoeF3xeDIDCdeQUp
x7w0RBLuxHDNSBmST2u1UIhAlq9W0LYhNrlaUQ8ealWchfeQe84HvAK6J29qaB6p
D5RiNzoMJ6DReaS181B0D1dQv/b5X9KO0fLoSsWdrOZZoWR8n+4lJUKN/CH9wzTP
SFb3CdJaPXRnOEkmOspSb1fIYsRzKUyPFRtU4fJk8Th0qJImgxtlV7tHON0I+RyC
qwbWQwox0Puu1sPsdeBtqkg8dRvDD6u+YyblT9pN25yx8Qi/Jf+BpchXJzjVRgh1
BN8Q8u5vLceMYFigSRrkSY4s6wlZIL/WzTI2+cJyR0MnVkkfl5Q8CxP3yyECWSCF
TyT+TlSI
=ZliI
-----END PGP SIGNATURE-----
--- End Message ---
