CVE-2016-4978 Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain
HighCVSS 7.2
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/artemis-pom(Maven) | < 1.4.0 | 1.4.0 |
| org.apache.activemq/artemis-pom(Maven) | = 1.0.0 | No fix listed |
| org.apache.activemq/artemis-pom(Maven) | = 1.1.0 | No fix listed |
| org.apache.activemq/artemis-pom(Maven) | = 1.2.0 | No fix listed |
| org.apache.activemq/artemis-pom(Maven) | = 1.3.0 | No fix listed |
| apache artemis | < 1.4.0 | 1.4.0 |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 7.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:1834 third-party-advisory vendor-advisory
- RHSA-2017:1835 third-party-advisory vendor-advisory
- RHSA-2017:1836 third-party-advisory vendor-advisory
- RHSA-2017:1837 third-party-advisory vendor-advisory
- RHSA-2017:3454 third-party-advisory vendor-advisory
- RHSA-2017:3455 third-party-advisory vendor-advisory
- RHSA-2017:3456 third-party-advisory vendor-advisory
- RHSA-2017:3458 third-party-advisory vendor-advisory
- RHSA-2018:1447 third-party-advisory vendor-advisory
- RHSA-2018:1448 third-party-advisory vendor-advisory
- RHSA-2018:1449 third-party-advisory vendor-advisory
- RHSA-2018:1450 third-party-advisory vendor-advisory
- RHSA-2018:1451 third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.blackhat.com technical-description third-party-advisory
- [activemq-users] 20160923 [CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability mailing-list vendor-advisory
- [activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978 mailing-list
- [activemq-issues] 20190529 [jira] [Closed] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978 mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117 mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26118 mailing-list
- web.archive.org
- github.com
- github.com product
- 93142 third-party-advisory vdb-entry