Apache ActiveMQ Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/11/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.activemq:activemq-client | ≥ 5.16.0, < 5.16.7≥ 5.17.0, < 5.17.6≥ 5.18.0, < 5.18.3< 5.15.16 | 5.16.75.17.65.18.35.15.16 |
| org.apache.activemq:activemq-openwire-legacy | ≥ 5.16.0, < 5.16.7≥ 5.17.0, < 5.17.6≥ 5.18.0, < 5.18.3≥ 5.8.0, < 5.15.16 | 5.16.75.17.65.18.35.15.16 |
| activemq | ≥ 5.16.0, < 5.16.7≥ 5.17.0, < 5.17.6≥ 5.18.0, < 5.18.3< 5.15.16 | 5.16.75.17.65.18.35.15.16 |
| activemq legacy openwire module | ≥ 5.16.0, < 5.16.7≥ 5.17.0, < 5.17.6≥ 5.18.0, < 5.18.3< 5.15.16 | 5.16.75.17.65.18.35.15.16 |
Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free