Is CVE-2018-11775 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 7%.

What products does CVE-2018-11775 affect?

Tracked products affected include ActiveMQ. Check the version you run to see whether it is affected.

How do I fix CVE-2018-11775?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2018-11775

Q: What is CVE-2018-11775?

CVE-2018-11775 is a high-severity software vulnerability (CWE-295) with a CVSS score of 7.4. TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enab

HIGH severity · CVSS 7.4 · CWE-295

7.4CVSS HIGH

Summary

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)7%

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products we track (1)

ActiveMQ

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txtAdvisory
http://www.securityfocus.com/bid/105335Advisory
http://www.securitytracker.com/id/1041618Advisory
https://access.redhat.com/errata/RHSA-2019:3892
https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E
https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b%40%3Cdev.activemq.apache.org%3E