CRITICAL10.0
GHSA-crg9-44h2-xw35
Apache ActiveMQ is vulnerable to Remote Code Execution
Quick fix
GHSA-crg9-44h2-xw35 — org.apache.activemq:activemq-client: upgrade to the fixed version with the command below.
# pom.xml: bump <version>5.15.16</version> for org.apache.activemq:activemq-clientDetails
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.activemq:activemq-client
Introduced in:
0Fixed in: 5.15.16Fix
# pom.xml: bump <version>5.15.16</version> for org.apache.activemq:activemq-clientMaven/org.apache.activemq:activemq-client
Introduced in:
5.16.0Fixed in: 5.16.7Fix
# pom.xml: bump <version>5.16.7</version> for org.apache.activemq:activemq-clientMaven/org.apache.activemq:activemq-client
Introduced in:
5.17.0Fixed in: 5.17.6Fix
# pom.xml: bump <version>5.17.6</version> for org.apache.activemq:activemq-clientMaven/org.apache.activemq:activemq-client
Introduced in:
5.18.0Fixed in: 5.18.3Fix
# pom.xml: bump <version>5.18.3</version> for org.apache.activemq:activemq-clientMaven/org.apache.activemq:activemq-openwire-legacy
Introduced in:
5.8.0Fixed in: 5.15.16Fix
# pom.xml: bump <version>5.15.16</version> for org.apache.activemq:activemq-openwire-legacyMaven/org.apache.activemq:activemq-openwire-legacy
Introduced in:
5.16.0Fixed in: 5.16.7Fix
# pom.xml: bump <version>5.16.7</version> for org.apache.activemq:activemq-openwire-legacyMaven/org.apache.activemq:activemq-openwire-legacy
Introduced in:
5.17.0Fixed in: 5.17.6Fix
# pom.xml: bump <version>5.17.6</version> for org.apache.activemq:activemq-openwire-legacyMaven/org.apache.activemq:activemq-openwire-legacy
Introduced in:
5.18.0Fixed in: 5.18.3Fix
# pom.xml: bump <version>5.18.3</version> for org.apache.activemq:activemq-openwire-legacyReferences
- https://nvd.nist.gov/vuln/detail/CVE-2023-46604[ADVISORY]
- https://github.com/apache/activemq/pull/1098[WEB]
- https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc[WEB]
- https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d[WEB]
- https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f[WEB]
- https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436[WEB]
- https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0[WEB]
- https://www.openwall.com/lists/oss-security/2023/10/27/5[WEB]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604[WEB]
- https://security.netapp.com/advisory/ntap-20231110-0010[WEB]
- https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html[WEB]
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html[WEB]
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html[WEB]
- https://issues.apache.org/jira/browse/AMQ-9370[WEB]
- https://github.com/apache/activemq[PACKAGE]
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt[WEB]
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604[WEB]
- http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html[WEB]
- http://seclists.org/fulldisclosure/2024/Apr/18[WEB]
- http://www.openwall.com/lists/oss-security/2023/10/27/5[WEB]