5.5Medium
CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuse
Description
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
Weakness (CWE):
CWE-1391
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Red Hat | AMQ Broker 7.13.0.OPR.1.GA | — | |
| Red Hat | Red Hat AMQ Broker 7.12.5 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| rhosemc | 1.0 | — | |
| — | activemq-artemis-operator | < 2.0.3 |
References and patches
- RHSA-2025:12355 vendor-advisory
- RHSA-2025:12473 vendor-advisory
- RHSA-2025:8147 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-4057 vdb-entry
- RHBZ#2362827 issue-tracking
- https://github.com/arkmq-org/activemq-artemis-operator/commit/d3482fab6d0060794226c9e5a6fa67d209abc35a
- https://github.com/arkmq-org/activemq-artemis-operator/issues/1130