Description
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| org.apache.activemq:activemq-client | Apache Software Foundation / Apache ActiveMQ | >= 0, < 5.15.16 | affected |
| org.apache.activemq:activemq-client | Apache Software Foundation / Apache ActiveMQ | >= 5.16.0, < 5.16.7 | affected |
| org.apache.activemq:activemq-client | Apache Software Foundation / Apache ActiveMQ | >= 5.17.0, < 5.17.6 | affected |
| org.apache.activemq:activemq-client | Apache Software Foundation / Apache ActiveMQ | >= 5.18.0, < 5.18.3 | affected |
| org.apache.activemq:activemq-openwire-legacy | Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module | >= 5.16.0, < 5.16.7 | affected |
| org.apache.activemq:activemq-openwire-legacy | Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module | >= 5.17.0, < 5.17.6 | affected |
| org.apache.activemq:activemq-openwire-legacy | Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module | >= 5.18.0, < 5.18.3 | affected |
| org.apache.activemq:activemq-openwire-legacy | Apache Software Foundation / Apache ActiveMQ Legacy OpenWire Module | >= 5.8.0, < 5.15.16 | affected |