CVE-2021-26117

Name	CVE-2021-26117
Description	The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2583-1, DLA-3657-1
Debian Bugs	982590

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
activemq (PTS)	buster	5.15.8-2	vulnerable
	buster (security)	5.15.16-0+deb10u1	fixed
	bullseye	5.16.1-1	fixed
	bookworm	5.17.2+dfsg-2	fixed
	sid, trixie	5.17.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
activemq	source	stretch	5.14.3-3+deb9u2	DLA-2583-1
activemq	source	buster	5.15.16-0+deb10u1	DLA-3657-1
activemq	source	(unstable)	5.16.1-1		982590

Notes

https://issues.apache.org/jira/browse/AMQ-8035
https://www.openwall.com/lists/oss-security/2021/01/27/6
https://gitbox.apache.org/repos/asf?p=activemq.git;h=c9f68f4c64b2687eee283b95538753665d2b229b