[Secure-testing-team] Bug#890352: activemq: CVE-2017-15709: information leak

[Salvatore Bonaccorso]

Source: activemq
Version: 5.14.3-3
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for activemq, filling the
bug based on the information available from [0] and [1].

CVE-2017-15709[0]:
| When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2
| it was found that certain system details (such as the OS and kernel
| version) are exposed as plain text.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-15709
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15709
[1] http://www.openwall.com/lists/oss-security/2018/02/13/4

Regards,
Salvatore