Fluid Attacks Database

Description

Improper Input Validation in Apache ActiveMQ Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.activemq:activemq-client	>=5.0.0 <5.11.3 \|\| >=5.12.0 <5.12.2	5.11.3, 5.12.2
debian 13	activemq	>=0 <5.13.2+dfsg-1	5.13.2+dfsg-1
debian 12	activemq	>=0 <5.13.2+dfsg-1	5.13.2+dfsg-1
debian 11	activemq	>=0 <5.13.2+dfsg-1	5.13.2+dfsg-1

Aliases

1. CVE-2015-52542. NVD-2015-52543. OSV-2015-52544. OSV-DEBIAN-2015-52545. GCVE-2015-52546. SECURITY-TRACKER-CVE-2015-5254

References

1. https://github.com/apache/activemq/commit/6f03921b31d9fefeddb0f4fa63150ed1f94a14b2. https://github.com/apache/activemq/commit/73a0caf758f9e4916783a205c7e422b4db279053. https://github.com/apache/activemq/commit/7eb9b218b2705cf9273e30ee2da026e43b6dd4e4. https://github.com/apache/activemq/commit/e7a4b53f799685e337972dd36ba0253c04bcc015. https://github.com/apache/activemq6. https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c053856807. https://issues.apache.org/jira/browse/AMQ-60138. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E9. http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt10. http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.html11. http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.html12. http://rhn.redhat.com/errata/RHSA-2016-0489.html13. http://rhn.redhat.com/errata/RHSA-2016-2035.html14. http://rhn.redhat.com/errata/RHSA-2016-2036.html15. http://www.debian.org/security/2016/dsa-352416. http://www.openwall.com/lists/oss-security/2015/12/08/617. http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html18. http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html19. https://github.com/jas502n/CVE-2015-5254

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.