CVE-2023-46604

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Activemq

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7…

27. Okt 2023

Ausgewertete Quellen

• Debian
  https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
• Debian
  https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
• Hersteller
  https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
• Hinweis
  http://seclists.org/fulldisclosure/2024/Apr/18
• Hinweis
  https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
• Hinweis
  https://security.netapp.com/advisory/ntap-20231110-0010/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604
• CISA
  Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
• NVD
  CVE-2023-46604