Apache ActiveMQ is vulnerable to Remote Code Execution
Critical severity
GitHub Reviewed
Published
Oct 27, 2023
to the GitHub Advisory Database
•
Updated Nov 28, 2023
Package
Affected versions
< 5.15.16
>= 5.16.0, < 5.16.7
>= 5.17.0, < 5.17.6
>= 5.18.0, < 5.18.3
Patched versions
5.15.16
5.16.7
5.17.6
5.18.3
>= 5.8.0, < 5.15.16
>= 5.16.0, < 5.16.7
>= 5.17.0, < 5.17.6
>= 5.18.0, < 5.18.3
5.15.16
5.16.7
5.17.6
5.18.3
Description
Published by the National Vulnerability Database
Oct 27, 2023
Published to the GitHub Advisory Database
Oct 27, 2023
Reviewed
Oct 30, 2023
Last updated
Nov 28, 2023
Credits
-
nmarcoccio Analyst
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
References