CVE-2016-4978
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.88% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- apache/artemis · redhat/jboss enterprise application platform
- Source
- secalert@redhat.com
References
- http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3EMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93142Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1834Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1835Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1836Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1837Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3456Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3458Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1447Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1448Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1449Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1450Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1451Third Party Advisory
- https://lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E
- https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdfTechnical Description, Third Party Advisory
- http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3EMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93142Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1834Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1835Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1836Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1837Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3456Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3458Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.