logo

Database

Insecure deserialization In org.apache.activemq:activemq-openwire-legacy

Description

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 11

10

Aliases

1. CVE-2023-466042. NVD-2023-466043. OSV-DEBIAN-2023-466044. OSV-2023-466045. GHSA-crg9-44h2-xw356. GCVE-2023-466047. SECURITY-TRACKER-CVE-2023-466048. ACTIVEMQ-CVE-2023-46604-announcement.txt9. lists.debian.org10. lists.debian.org

References

1. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-466042. https://euvd.enisa.europa.eu/vulnerability/CVE-2023-466043. https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-46604.yaml4. https://github.com/trganda/ActiveMQ-RCE5. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb6. http://www.openwall.com/lists/oss-security/2023/10/27/57. https://github.com/apache/activemq/pull/10988. https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc9. https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d10. https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f11. https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad5243612. https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f013. https://www.openwall.com/lists/oss-security/2023/10/27/514. https://security.netapp.com/advisory/ntap-20231110-001015. https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html16. https://issues.apache.org/jira/browse/AMQ-937017. https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt18. https://activemq.apache.org/security-advisories.data/CVE-2023-4660419. http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html20. http://seclists.org/fulldisclosure/2024/Apr/18

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.