search

snowdensb / Leo

The Leo framework - The VINCI-developed Natural Language Processing(NLP) infrastructure using UIMA.
Apache License 2.0
0 stars 0 forks source link

CVE-2023-46604 (Critical) detected in multiple libraries #204

Open mend-for-github-com[bot] opened 1 year ago

mend-for-github-com[bot] commented 1 year ago

CVE-2023-46604 - Critical Severity Vulnerability

Vulnerable Libraries - activemq-openwire-legacy-5.14.0.jar, activemq-all-5.14.0.jar, activemq-client-5.14.0.jar

activemq-openwire-legacy-5.14.0.jar

The ActiveMQ Openwire Legacy Support Module

Library home page: http://www.apache.org/

Path to dependency file: /core/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/activemq/activemq-openwire-legacy/5.14.0/activemq-openwire-legacy-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-openwire-legacy/5.14.0/activemq-openwire-legacy-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-openwire-legacy/5.14.0/activemq-openwire-legacy-5.14.0.jar

Dependency Hierarchy: - uimaj-as-activemq-2.9.0.jar (Root Library) - activemq-broker-5.14.0.jar - :x: **activemq-openwire-legacy-5.14.0.jar** (Vulnerable Library)

activemq-all-5.14.0.jar

Puts together an ActiveMQ jar bundle

Library home page: http://www.apache.org/

Path to dependency file: /client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/activemq/activemq-all/5.14.0/activemq-all-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-all/5.14.0/activemq-all-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-all/5.14.0/activemq-all-5.14.0.jar

Dependency Hierarchy: - uimaj-as-activemq-2.9.0.jar (Root Library) - activemq-web-5.14.0.jar - :x: **activemq-all-5.14.0.jar** (Vulnerable Library)

activemq-client-5.14.0.jar

The ActiveMQ Client implementation

Library home page: http://www.apache.org/

Path to dependency file: /client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/activemq/activemq-client/5.14.0/activemq-client-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-client/5.14.0/activemq-client-5.14.0.jar,/home/wss-scanner/.m2/repository/org/apache/activemq/activemq-client/5.14.0/activemq-client-5.14.0.jar

Dependency Hierarchy: - uimaj-as-activemq-2.9.0.jar (Root Library) - :x: **activemq-client-5.14.0.jar** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

Publish Date: 2023-10-27

URL: CVE-2023-46604

CVSS 3 Score Details (10.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

Release Date: 2023-10-27

Fix Resolution: org.apache.activemq:activemq-client:5.15.16,5.16.7,5.17.6,5.18.3, org.apache.activemq:activemq-openwire-legacy:5.15.16,5.16.7,5.17.6,5.18.3, org.apache.activemq:activemq-client-jakarta:5.18.3, org.apache.activemq:activemq-all:5.15.16,5.16.7,5.17.6,5.18.3, org.apache.activemq:activemq-osgi:5.15.16,5.16.7,5.17.6,5.18.3