Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1123
_____________________________________________________________________

DATE                : 04/11/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache ActiveMQ versions prior
                                to 6.4.0, 6.3.3, 5.19.12.

====================================================================
https://lists.apache.org/thread.html/r01vywy531tc9zoppcgdx4hqw775vkx8
_____________________________________________________________________

CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows
authorization bypass via DN injection

Severity: Moderate 

Affected versions:

- Apache ActiveMQ 6.3.0 before 6.3.3
- Apache ActiveMQ 5.19.0 before 5.19.12
- Apache ActiveMQ 6.4.0 unaffected

Description:

Input validation vulnerability in Apache ActiveMQ configured to use
the LDAPAuthorizationMapPlugin allows an authenticated attacker to
create or address a destination with a crafted name containing
LDAP DN special characters (such as comma, plus, equals, backslash)
can manipulate the LDAP search base used for ACL lookups.


This issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from
5.19.0 before 5.19.12.


Users are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12,
which fixes the issue.

Credit:

Rishabh Soni (Azmendus) <ri...@gmail.com> (finder)

References:

https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-108500


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================