[<prev] [next>] [day] [month] [year] [list]
Message-ID: <02573012-9cb8-a624-f621-982539a936ef@apache.org>
Date: Fri, 27 Oct 2023 14:44:26 +0000
From: "Christopher L. Shannon" <cshannon@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire
Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a
remote code execution (RCE) attack
Affected versions:
- Apache ActiveMQ 5.18.0 before 5.18.3
- Apache ActiveMQ 5.17.0 before 5.17.6
- Apache ActiveMQ 5.16.0 before 5.16.7
- Apache ActiveMQ before 5.15.16
- Apache ActiveMQ Legacy OpenWire Module 5.18.0 before 5.18.3
- Apache ActiveMQ Legacy OpenWire Module 5.17.0 before 5.17.6
- Apache ActiveMQ Legacy OpenWire Module 5.16.0 before 5.16.7
- Apache ActiveMQ Legacy OpenWire Module 5.8.0 before 5.15.16
Description:
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
This issue is being tracked as AMQ-9370
References:
https://activemq.apache.org/security-advisories.data/CVE-2023-46604
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-46604
https://issues.apache.org/jira/browse/AMQ-9370
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
