[GHSA-3wfj-vh84-732p] org.apache.activemq:activemq-client: backport to 5.10.2 not reflected

[zyl71]

Updates

• Affected products

Comments
Current record: Maven:org.apache.activemq:activemq-client: introduced=0 fixed=5.11.0
Proposed: Maven:org.apache.activemq:activemq-client: introduced=0 fixed=5.10.2

The record's 'fixed 5.11.0' comes from the CVE text ('before 5.11.0'), but the 5.10.x branch received the same one-hunk change (f07e6a53, removing the unauthenticated 'shutdown' ControlCommand handling) and shipped it in 5.10.2 on 2015-02-13. Checked directly in the Maven Central sources jars: activemq-broker 5.10.1 still has the System.exit branch, 5.10.2 and 5.11.0 do not. Apache's own advisory lists affected versions as 5.0.0 - 5.10.1, which matches. Since Maven orders 5.10.2 < 5.11.0 with nothing in between, 0->5.10.2 is the exact range. Side note: the vulnerable class lives in activemq-broker rather than activemq-client.

Release lines: Lines with releases around the fix (trunk fix 2014-08-13, backport 2015-02-12): 5.9 ended with 5.9.1 (2014-04-01) before the fix -> stays affected; 5.10: 5.10.0 (2014-06-05) and 5.10.1 (2015-01-15) still contain the shutdown branch (sources jar), 5.10.2 (2015-02-13) is the first 5.10.x with the backport; 5.11: 5.11.0 (2015-01-30) already contains the trunk commit. Because Maven orders 5.10.2 < 5.11.0 and nothing sits between them, the single range 0->5.10.2 marks exactly 5.0.0..5.10.1 affected and 5.10.2, 5.11.x+ not affected.

Maintainer statements: Apache ActiveMQ advisory CVE-2014-3576-announcement.txt: 'Versions Affected: Apache ActiveMQ 5.0.0 - 5.10.1 ... Mitigation: Upgrade to Apache ActiveMQ 5.11.0'. Naming 5.10.1 as the last affected version is consistent with 5.10.2 being fixed; the record's 'before 5.11.0' wording comes from the NVD/CVE text and wrongly covers 5.10.2.

Evidence:

• https://api.github.com/repos/apache/activemq/compare/activemq-5.10.2...f07e6a53216f9388185ac2b39f366f3bfd6a8a55 — Status behind (ahead 0, behind 2): tag activemq-5.10.2 contains the 5.10.x backport commit
• https://api.github.com/repos/apache/activemq/compare/activemq-5.10.1...f07e6a53216f9388185ac2b39f366f3bfd6a8a55 — Status ahead (ahead 3): 5.10.1 does not contain the backport
• https://api.github.com/repos/apache/activemq/compare/activemq-5.11.0...00921f22ff9a8792d7663ef8fadd4823402a6324 — Status behind: 5.11.0 contains the trunk fix
• apache/activemq@f07e6a5 — Backport diff: removes 'if (control.equals("shutdown")) System.exit(0)' from TransportConnection.processControlCommand (identical to trunk commit 00921f22)
• https://repo1.maven.org/maven2/org/apache/activemq/activemq-broker/5.10.2/activemq-broker-5.10.2-sources.jar — Artifact grep: TransportConnection.java processControlCommand() only 'return null' (fix present); dated 2015-02-13
• https://repo1.maven.org/maven2/org/apache/activemq/activemq-broker/5.10.1/activemq-broker-5.10.1-sources.jar — Artifact grep: still contains control.equals("shutdown") / System.exit(0) (vulnerable); dated 2015-01-15
• https://activemq.apache.org/security-advisories.data/CVE-2014-3576-announcement.txt — Vendor advisory: 'Versions Affected: Apache ActiveMQ 5.0.0 - 5.10.1'; 'Mitigation: Upgrade to Apache ActiveMQ 5.11.0'

Version checks:

• org.apache.activemq:activemq-client (vulnerable class ships in activemq-broker, same version) 5.10.2 (registry 2015-02-13): contains fix: yes via backport f07e6a53216f9388185ac2b39f366f3bfd6a8a55; method: compare-api (activemq-5.10.2...f07e6a53 = behind 2) + artifact-grep (activemq-broker-5.10.2-sources.jar: processControlCommand no longer contains the shutdown/System.exit branch); previous version 5.10.1: does not contain the fix
• org.apache.activemq:activemq-client 5.11.0 (registry 2015-01-30): contains fix: yes; method: compare-api (activemq-5.11.0...00921f22 = behind 249) + artifact-grep (activemq-broker-5.11.0-sources.jar); previous version 5.10.1 (latest release before it; 5.11.0 is the first of its line): does not contain the fix

This comes from a systematic comparison of advisory ranges with fix commits and published registry artifacts. Happy to adjust if the maintainers intend otherwise.