{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "LDAPLoginModule allows empty password authentication",
    "tracking": {
      "current_release_date": "2026-07-23T19:14:15+00:00",
      "generator": {
        "date": "2026-07-23T19:14:15+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.1.0"
        }
      },
      "id": "CVE-2014-3612",
      "initial_release_date": "2015-02-05T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T19:14:15+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Container Platform",
            "product": {
              "name": "OpenShift Container Platform",
              "product_id": "openshift-enterprise-1",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:1"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 2.2.0",
            "product": {
              "name": "OpenShift Container Platform 2.2.0",
              "product_id": "openshift-enterprise-2.2",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:2"
              }
            }
          },
          {
            "category": "product_version",
            "name": "activemq",
            "product": {
              "name": "activemq",
              "product_id": "activemq",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/activemq"
              }
            }
          },
          {
            "category": "product_version",
            "name": "activemq-client",
            "product": {
              "name": "activemq-client",
              "product_id": "activemq-client",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/activemq-client"
              }
            }
          },
          {
            "category": "product_version",
            "name": "activemq",
            "product": {
              "name": "activemq",
              "product_id": "activemq.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/activemq?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq as a component of OpenShift Container Platform",
          "product_id": "openshift-enterprise-1:activemq"
        },
        "product_reference": "activemq",
        "relates_to_product_reference": "openshift-enterprise-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq-client as a component of OpenShift Container Platform",
          "product_id": "openshift-enterprise-1:activemq-client"
        },
        "product_reference": "activemq-client",
        "relates_to_product_reference": "openshift-enterprise-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq.src as a component of OpenShift Container Platform",
          "product_id": "openshift-enterprise-1:activemq.src"
        },
        "product_reference": "activemq.src",
        "relates_to_product_reference": "openshift-enterprise-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "activemq.src as a component of OpenShift Container Platform 2.2.0",
          "product_id": "openshift-enterprise-2.2:activemq.src"
        },
        "product_reference": "activemq.src",
        "relates_to_product_reference": "openshift-enterprise-2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-3612",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2014-09-01T00:00:00+00:00",
      "notes": [
        {
          "category": "description",
          "text": "It was found that if a configured LDAP server supported the unauthenticated authentication mechanism (as described by RFC 4513), the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service (JAAS), would consider an authentication attempt to be successful for a valid user that provided an empty password. A remote attacker could use this flaw to bypass the authentication mechanism of an application using LDAPLoginModule, and assume a role of any valid user within that application.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "openshift-enterprise-1:activemq",
          "openshift-enterprise-1:activemq-client",
          "openshift-enterprise-1:activemq.src",
          "openshift-enterprise-2.2:activemq.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3612"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3612"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3612"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "openshift-enterprise-1:activemq",
            "openshift-enterprise-1:activemq-client",
            "openshift-enterprise-1:activemq.src",
            "openshift-enterprise-2.2:activemq.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "version": "2.0",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "baseScore": 7.5
          },
          "products": [
            "openshift-enterprise-1:activemq",
            "openshift-enterprise-1:activemq-client",
            "openshift-enterprise-1:activemq.src",
            "openshift-enterprise-2.2:activemq.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "openshift-enterprise-1:activemq",
            "openshift-enterprise-1:activemq-client",
            "openshift-enterprise-1:activemq.src",
            "openshift-enterprise-2.2:activemq.src"
          ]
        }
      ],
      "title": "LDAPLoginModule allows empty password authentication"
    }
  ]
}