ActiveMQ Artemis Password Regeneration Flaw in AMQ Broker Operator

A vulnerability exists in ActiveMQ Artemis within the AMQ Broker Operator. The issue arises because the operator-generated passwords do not refresh between different Custom Resource (CR) dependencies. This flaw affects several starting credentials, including AMQ_PASSWORD, AMQ_USER, AMQ_CLUSTER_PASSWORD, and AMQ_CLUSTER_USER, which fail to regenerate between separate CR instances.

Impact

This vulnerability leads to the reuse of starting credentials, which can create security risks by allowing unauthorized access or actions under the identity of the reused credentials.

Remediation

Users can update to the latest AMQ Broker version 7.13.0.OPR.1.GA, which addresses this vulnerability. Instructions for updating can be found in the Red Hat AMQ Broker 7 documentation.