Critical: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ Fuse 6.3 R20 HF1 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate any class on the classpath. This issue happens when...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 This repository contains an exploit script and...

Apache ActiveMQ vulnerability used in ransomware attacks

On the 27 October, the Apache Software Foundation ASF announced a very serious vulnerability in Apache ActiveMQ that can be used to achieve remote code execution RCE. The Cybersecurity and Infrastructure Security Agency has now added this vulnerability to its Known Exploited Vulnerabilities...

OESA-2023-1778 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized clas...

Apache ActiveMQ < 5.15.16 / 5.16.x < 5.16.7 / 5.17.x < 5.17.6 / 5.18.x < 5.18.3 RCE

Apache ActiveMQ is vulnerable to remote code execution. The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. User...

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath...

VulnCheck KEV: CVE-2023-46604

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath...

Apache ActiveMQ Code Execution

The vulnerability of the Apache ActiveMQ software platform lies in the recovery of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code by creating a class based on the OpenWire protocol...

CVE-2023-46604

A flaw was found in Apache ActiveMQ, specifically the OpenWire Module. This flaw may allow a remote malicious user to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate any class on the classpath. This issue happens when...

Remote Code Execution

activemq is vulnerable to Remote Code Execution. The vulnerability is due to BaseDataStreamMarshaller.java as there is no class validation and does not verify that the loaded class is a valid Throwable. This allows an attacker to manipulate serialized class types within the OpenWire protocol,...

Apache ActiveMQ Deserialization Vulnerability

Apache ActiveMQ is the United States Apache Apache Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework and so on. Apache ActiveMQ there is a deserialization vulnerability , the vulnerability stems from the application in...

Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users...

GHSA-CRG9-44H2-XW35 Apache ActiveMQ is vulnerable to Remote Code Execution

Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. Users...

com.chutneytesting:chutney-kotlin-dsl (>=0.1.18, <=1.0.1), com.codbex.aion:codbex-aion-platform (>=0.5.6, <=0.5.7) +151 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.17.0, <=5.17.5)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.17.0, =0.1.18, =0.5.6, =0.5.6, =0.5.6, =0.3.0, =0.3.0, =0.5.3, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2023-46604 Source advisory: GHSA-CRG9-44H2-XW35...

com.chutneytesting:action-impl (>=2.2.1, <=2.5.1), com.chutneytesting:chutney-junit-engine (>=2.2.1, <=2.5.1) +37 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.18.0, <=5.18.2)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.18.0, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =2.19.1, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.2 and more Source cves:...

com.chutneytesting:action-impl (>=2.2.1, <=2.5.1), com.chutneytesting:chutney-junit-engine (>=2.2.1, <=2.5.1) +37 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.18.0, <=5.18.2)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.18.0, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =rc0-0.19.12-2023-10-27, =2.19.1, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.0, =5.18.2 and more Source cves:...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +957 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.8.0, <=5.15.15)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2023-46604 Source advisory:...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +957 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.8.0, <=5.15.15)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2023-46604 Source advisory: GHSA-CRG9-44H2-X...

be.yildiz-games:module-messaging-activemq (1.0.14), ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0) +298 more potentially affected by CVE-2023-46604 via org.apache.activemq:activemq-openwire-legacy (>=5.16.0, <=5.16.6)

org.apache.activemq:activemq-openwire-legacy MAVEN version =5.16.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.3.0, =2.3.0, =2.3.0, =2.3.0, =1.6.0, =1.4.6, =0.1.10, =1.4.6, =1.4.6, =1.5.4 and more Source cves: CVE-2023-46604 Source advisory: GHSA-CRG9-44H2-XW35...