The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3936 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3936-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     October 25, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : activemq     Version        : 5.16.1-1+deb11u1     CVE ID         : CVE-2022-41678 CVE-2023-46604     Debian Bug     : 1054909

    Two vulnerabilities were found in Apache ActiveMQ, a Java-based message broker.

    CVE-2022-41678

        Deserialization vulnerability on Jolokia that allows authenticated users to         perform arbitrary code execution.

    CVE-2023-46604

        The Java OpenWire protocol marshaller is vulnerable to arbitrary code         execution. This vulnerability may allow a remote attacker with network         access to run arbitrary shell commands by manipulating serialized class         types in either a Java-based OpenWire broker or client.

    For Debian 11 bullseye, these problems have been fixed in version     5.16.1-1+deb11u1.

    We recommend that you upgrade your activemq packages.

    For the detailed security status of activemq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/activemq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3936 : activemq - security update

critical Nessus Plugin ID 209676

Version 1.2

Version 1.1

Version 1.2 Oct 28, 2024, 9:20 AM Exploit attributes ("Exploit framework core" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202410280920
Version 1.1 Oct 25, 2024, 10:22 PM New Plugin Feed: 202410252222