CVE-2025-58712
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A container privilege escalation flaw was found in certain AMQ Broker images. The /etc/passwd file is created with group-writable permissions during build time, allowing an attacker who can execute commands within the container (even as a non-root user) to modify the file due to root group membership. This could allow adding a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Risk Assessment
An attacker able to execute commands in the container could gain full root privileges, leading to container takeover and potentially further escalation in the environment. The risk affects AMQ Broker deployments based on vulnerable images.
Recommendation
Update AMQ Broker images to a version containing the fix (with correct /etc/passwd permissions). Restrict command execution within containers and apply the principle of least privilege.
Other vulnerabilities in AMQ Broker
Original NVD description (English source)
A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS