Vulnerabilities > CVE-2018-1275
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
Vulnerable Configurations
Nessus
NASL family Misc. NASL id ORACLE_WEBLOGIC_SERVER_CPU_JUL_2018.NASL description The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework (Sample Apps) subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. (CVE-2018-1275) - An unspecified vulnerability in the WLS Core Components subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. (CVE-2018-2893) - An unspecified vulnerability in the WLS - Web Services subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker with HTTP access to compromise and takeover a WebLogic server. (CVE-2018-2894) In addition, Oracle WebLogic Server is affected by several other lower scoring vulnerabilities in the WLS Core Components, JSF, SAML, and Console (jackson-databind) subcomponents. Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 111209 published 2018-07-20 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111209 title Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(111209); script_version("1.15"); script_cvs_date("Date: 2019/04/30 14:00:04"); script_cve_id( "CVE-2018-1275", "CVE-2018-2893", "CVE-2018-2894", "CVE-2018-2933", "CVE-2018-2935", "CVE-2018-2987", "CVE-2018-2998", "CVE-2018-7489" ); script_bugtraq_id( 103771, 103203, 104817 ); script_name(english:"Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)"); script_summary(english:"Checks for the patch."); script_set_attribute(attribute:"synopsis", value: "An application server installed on the remote host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework (Sample Apps) subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. (CVE-2018-1275) - An unspecified vulnerability in the WLS Core Components subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. (CVE-2018-2893) - An unspecified vulnerability in the WLS - Web Services subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker with HTTP access to compromise and takeover a WebLogic server. (CVE-2018-2894) In addition, Oracle WebLogic Server is affected by several other lower scoring vulnerabilities in the WLS Core Components, JSF, SAML, and Console (jackson-databind) subcomponents. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number." ); # http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50f36723"); script_set_attribute(attribute:"solution", value: "Apply the appropriate patch according to the July 2018 Oracle Critical Patch Update advisory. Refer to Oracle for any additional patch instructions or mitigation options."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1275"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"d2_elliot_name", value:"Oracle WebLogic Server WLS File Upload"); script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/17"); script_set_attribute(attribute:"patch_publication_date", value:"2018/07/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/20"); script_set_attribute(attribute:"agent", value:"all"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_weblogic_server_installed.nbin", "os_fingerprint.nasl"); script_require_keys("installed_sw/Oracle WebLogic Server"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); include("obj.inc"); include("spad_log_func.inc"); app_name = "Oracle WebLogic Server"; install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); ohome = install["Oracle Home"]; subdir = install["path"]; version = install["version"]; fix = NULL; fix_ver = NULL; spad_log(message:"checking version [" + version + "]"); # individual security patches if (version =~ "^12\.2\.1\.3($|[^0-9])") { fix_ver = "12.2.1.3.180717"; fix = make_list("27912627"); } else if (version =~ "^12\.2\.1\.2($|[^0-9])") { fix_ver = "12.2.1.2.180717"; fix = make_list("27741413"); } else if (version =~ "^12\.1\.3\.") { fix_ver = "12.1.3.0.180717"; fix = make_list("27919943"); } else if (version =~ "^10\.3\.6\.") { fix_ver = "10.3.6.0.180717"; fix = make_list("B47X"); # patchid is obtained from the readme and 10.3.6.x assets are different } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); spad_log(message:"checking fix [" + obj_rep(fix) + "]"); PATCHED=FALSE; # Iterate over the list of patches and check the install for the patchID foreach id (fix) { spad_log(message:"Checking fix id: [" + id +"]"); if (install[id]) { PATCHED=TRUE; break; } } VULN=FALSE; if (ver_compare(ver:version, fix:fix_ver, strict:FALSE) == -1) VULN=TRUE; if (PATCHED || !VULN) audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); os = get_kb_item_or_exit("Host/OS"); if ('windows' >< tolower(os)) { port = get_kb_item("SMB/transport"); if (!port) port = 445; } else port = 0; report = '\n Oracle Home : ' + ohome + '\n Install path : ' + subdir + '\n Version : ' + version + '\n Fixes : ' + join(sep:", ", fix); security_report_v4(extra:report, severity:SECURITY_HOLE, port:port);
NASL family Misc. NASL id ORACLE_GOLDENGATE_FOR_BIG_DATA_CPU_OCT_2018.NASL description The version of Oracle GoldenGate for Big Data application located on the remote host is 12.2.0.1.x less than 12.2.0.1.10 or 12.3.1.1.x less than 12.3.1.1.6. It is, therefore, affected by multiple vulnerabilities : - An unspecified vulnerability exists in Oracle GoldenGate for Big Data. An authenticated, remote attacker can exploit this, via unknown vectors, to compromise confidentiality, integrity, and availability. (CVE-2016-0635) - An authorization bypass vulnerability exists in Spring Framework 5.0.5 when used in conjunction with Spring Security and using method security. An authenticated, remote attacker can exploit this to gain unauthorized access to methods that should be restricted. (CVE-2018-1258) - A remote code execution vulnerability exists in the Spring Framework. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. (CVE-2018-1275) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-03-18 modified 2020-03-05 plugin id 134225 published 2020-03-05 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134225 title Oracle GoldenGate for Big Data 12.2.0.1.x < 12.2.0.1.10 / 12.3.1.1.x < 12.3.1.1.6 Multiple Vulnerabilities (Oct 2018 CPU) code # # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(134225); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/06"); script_cve_id("CVE-2016-0635", "CVE-2018-1258", "CVE-2018-1275"); script_bugtraq_id(91869, 103771, 104222); script_name(english:"Oracle GoldenGate for Big Data 12.2.0.1.x < 12.2.0.1.10 / 12.3.1.1.x < 12.3.1.1.6 Multiple Vulnerabilities (Oct 2018 CPU)"); script_set_attribute(attribute:"synopsis", value: "The Oracle GoldenGate for Big Data application on the remote host is affected by a denial of service vulnerability."); script_set_attribute(attribute:"description", value: "The version of Oracle GoldenGate for Big Data application located on the remote host is 12.2.0.1.x less than 12.2.0.1.10 or 12.3.1.1.x less than 12.3.1.1.6. It is, therefore, affected by multiple vulnerabilities : - An unspecified vulnerability exists in Oracle GoldenGate for Big Data. An authenticated, remote attacker can exploit this, via unknown vectors, to compromise confidentiality, integrity, and availability. (CVE-2016-0635) - An authorization bypass vulnerability exists in Spring Framework 5.0.5 when used in conjunction with Spring Security and using method security. An authenticated, remote attacker can exploit this to gain unauthorized access to methods that should be restricted. (CVE-2018-1258) - A remote code execution vulnerability exists in the Spring Framework. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. (CVE-2018-1275) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuoct2018.html"); script_set_attribute(attribute:"solution", value: "Apply the appropriate patches according to the October 2018 Oracle Critical Patch Update advisory."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-0635"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/18"); script_set_attribute(attribute:"patch_publication_date", value:"2018/10/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/05"); script_set_attribute(attribute:"potential_vulnerability", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:goldengate_application_adapters"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_goldengate_for_big_data_installed.nbin"); script_require_keys("Settings/ParanoidReport", "installed_sw/Oracle GoldenGate for Big Data"); exit(0); } include('vcf.inc'); // Paranoid because the detection is looking for the presence of JAR files. It's possible that the customer has JAR // files from outdated versions on their system, but is not currently using them. if (report_paranoia < 2) audit(AUDIT_PARANOID); app_name = 'Oracle GoldenGate for Big Data'; app_info = vcf::get_app_info(app:app_name); constraints = [ { 'min_version':'12.2.0.1', 'fixed_version':'12.2.0.1.10' }, { 'min_version':'12.3.1.1', 'fixed_version':'12.3.1.1.6' } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
NASL family Misc. NASL id ORACLE_OATS_CPU_JUL_2018.NASL description The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Apache Log4j 2.x before 2.8.2 due to the ability to receive serialized log events from another application. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2017-5645) - A remote code execution vulnerability exists in Spring Framework due to the exposure of STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2018-1275) last seen 2020-06-01 modified 2020-06-02 plugin id 111210 published 2018-07-20 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111210 title Oracle Application Testing Suite Multiple Vulnerabilities (April / July 2018 CPU) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(111210); script_version("1.3"); script_cvs_date("Date: 2019/11/04"); script_cve_id("CVE-2017-5645", "CVE-2018-1275"); script_bugtraq_id(97702, 103771); script_name(english:"Oracle Application Testing Suite Multiple Vulnerabilities (April / July 2018 CPU)"); script_summary(english:"Checks version of Oracle Application Testing suite"); script_set_attribute(attribute:"synopsis", value: "The remote host has a web application installed that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Apache Log4j 2.x before 2.8.2 due to the ability to receive serialized log events from another application. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2017-5645) - A remote code execution vulnerability exists in Spring Framework due to the exposure of STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2018-1275)"); # http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76507bf8"); # http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50f36723"); script_set_attribute(attribute:"solution", value: "Apply the appropriate patch according to the April / July 2018 Oracle Critical Patch Update advisory."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1275"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/17"); script_set_attribute(attribute:"patch_publication_date", value:"2018/07/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/20"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_testing_suite"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_application_testing_suite_installed.nbin"); script_require_keys("installed_sw/Oracle Application Testing Suite"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("smb_func.inc"); include("install_func.inc"); app_name = "Oracle Application Testing Suite"; install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); ohome = install["Oracle Home"]; subdir = install["path"]; version = install["version"]; fix = NULL; fix_ver = NULL; # individual security patches if (version =~ "^13\.2\.0\.1\.") { fix_ver = "13.2.0.1.215"; fix = "27794987"; } else if (version =~ "^13\.1\.0\.1\.") { fix_ver = "13.1.0.1.416"; fix = "27794982"; } else if (version =~ "^12\.5\.0\.3\.") { fix_ver = "12.5.0.3.1059"; fix = "27794971"; } if ( # Vulnerble versions that have patch (!isnull(fix_ver) && ver_compare(ver:version, fix:fix_ver, strict:FALSE) == -1) || # Vulnerable versions that require upgrade and then patch (ver_compare(ver:version, fix:'12.5.0.3.0', strict:FALSE) == -1) ) { report = '\n Oracle home : ' + ohome + '\n Install path : ' + subdir + '\n Version : ' + version; if (!isnull(fix_ver)) { report += '\n Required patch : ' + fix + '\n'; } else { report += '\n Upgrade to 12.5.0.3 / 13.1.0.1 / 13.2.0.1 and apply the ' + 'appropriate patch according to the April / July 2018 Oracle ' + 'Critical Patch Update advisory.' + '\n'; } security_report_v4(extra:report, port:0, severity:SECURITY_HOLE); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir);
NASL family CGI abuses NASL id ORACLE_PRIMAVERA_GATEWAY_CPU_OCT_2018.NASL description According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.15, 16.x prior to 16.2.8, or 17.x prior to 17.12.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-04-30 modified 2018-11-02 plugin id 118714 published 2018-11-02 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118714 title Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2018 CPU) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(118714); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/27"); script_cve_id("CVE-2015-9251", "CVE-2018-1275", "CVE-2018-7489"); script_name(english:"Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2018 CPU)"); script_summary(english:"Checks the version of Oracle Primavera Gateway."); script_set_attribute(attribute:"synopsis", value: "An application running on the remote web server is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.15, 16.x prior to 16.2.8, or 17.x prior to 17.12.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); # https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixPVA script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4d864b63"); script_set_attribute(attribute:"solution", value: "Upgrade to Oracle Primavera Gateway version 15.2.15 / 16.2.8 / 17.12.3 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-7489"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/01/28"); script_set_attribute(attribute:"patch_publication_date", value:"2018/10/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/02"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"x-cpe:/a:oracle:primavera_gateway"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_primavera_gateway.nbin"); script_require_keys("installed_sw/Oracle Primavera Gateway"); script_require_ports("Services/www", 8006); exit(0); } include("http.inc"); include("vcf.inc"); get_install_count(app_name:"Oracle Primavera Gateway", exit_if_zero:TRUE); port = get_http_port(default:8006); app_info = vcf::get_app_info(app:"Oracle Primavera Gateway", port:port); vcf::check_granularity(app_info:app_info, sig_segments:2); constraints = [ { "min_version" : "15.0.0", "fixed_version" : "15.2.15" }, { "min_version" : "16.0.0", "fixed_version" : "16.2.8" }, { "min_version" : "17.0.0", "fixed_version" : "17.12.3" } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, flags:{"xss":TRUE});
Redhat
advisories |
|
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/103771
- http://www.securityfocus.com/bid/103771
- http://www.securitytracker.com/id/1041301
- http://www.securitytracker.com/id/1041301
- https://access.redhat.com/errata/RHSA-2018:1320
- https://access.redhat.com/errata/RHSA-2018:1320
- https://access.redhat.com/errata/RHSA-2018:2939
- https://access.redhat.com/errata/RHSA-2018:2939
- https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
- https://pivotal.io/security/cve-2018-1275
- https://pivotal.io/security/cve-2018-1275
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html