apache-activemq-artemis.advisories.yaml

schema-version: 2.0.2

package:
  name: apache-activemq-artemis

advisories:
  - id: CGA-5w34-p6wm-7m57
    aliases:
      - CVE-2025-24970
      - GHSA-4g8c-wm8x-jfhw
    events:
      - timestamp: 2025-02-11T09:09:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-activemq-artemis
            componentID: 9efd0f149c202d27
            componentName: netty-handler
            componentVersion: 4.1.115.Final
            componentType: java-archive
            componentLocation: /opt/activemq-artemis/lib/netty-handler-4.1.115.Final.jar
            scanner: grype
      - timestamp: 2025-02-19T23:36:41Z
        type: fixed
        data:
          fixed-version: 2.39.0-r1

  - id: CGA-r643-vp3w-92j3
    aliases:
      - CVE-2025-25193
      - GHSA-389x-839f-4rhx
    events:
      - timestamp: 2025-02-11T09:09:54Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: apache-activemq-artemis
            componentID: f3e98d110942f8e4
            componentName: netty-common
            componentVersion: 4.1.115.Final
            componentType: java-archive
            componentLocation: /opt/activemq-artemis/lib/netty-common-4.1.115.Final.jar
            scanner: grype
      - timestamp: 2025-02-13T19:41:11Z
        type: false-positive-determination
        data:
          type: vulnerable-code-cannot-be-controlled-by-adversary
          note: Vulnerability affects only Windows systems.