Date: Fri, 27 Oct 2023 14:44:26 +0000 From: "Christopher L. Shannon" <cshannon@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack Affected versions: - Apache ActiveMQ 5.18.0 before 5.18.3 - Apache ActiveMQ 5.17.0 before 5.17.6 - Apache ActiveMQ 5.16.0 before 5.16.7 - Apache ActiveMQ before 5.15.16 - Apache ActiveMQ Legacy OpenWire Module 5.18.0 before 5.18.3 - Apache ActiveMQ Legacy OpenWire Module 5.17.0 before 5.17.6 - Apache ActiveMQ Legacy OpenWire Module 5.16.0 before 5.16.7 - Apache ActiveMQ Legacy OpenWire Module 5.8.0 before 5.15.16 Description: Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue. This issue is being tracked as AMQ-9370 References: https://activemq.apache.org/security-advisories.data/CVE-2023-46604 https://activemq.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-46604 https://issues.apache.org/jira/browse/AMQ-9370
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.