The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
CVE-2023-46604 - Critical Severity Vulnerability
Puts together an ActiveMQ jar bundle
Path to dependency file: /pom.xml
Path to vulnerable library: /20201127105057_JYADOJ/downloadResource_XKWWQX/20201127105931/activemq-all-5.10.0.jar
Dependency Hierarchy: - :x: **activemq-all-5.10.0.jar** (Vulnerable Library)
Found in HEAD commit: 26994796809a3a8687a975e3361495d457afe47c
Found in base branch: master
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Publish Date: 2023-10-27
URL: CVE-2023-46604
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
Release Date: 2023-10-27
Fix Resolution: 5.15.16
Step up your Open Source Security Game with Mend here