
CVE-2018-11775: ActiveMQ Client - Missing TLS Hostname Verification

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache ActiveMQ 5.0.0 - 5.15.5

Description:

TLS hostname verification when using the Apache ActiveMQ Client was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Mitigation:

Upgrade to Apache ActiveMQ 5.15.6

Credit:
This issue was discovered by Peter Stöckli (Alphabot Security)