CVE-2015-5254
published 2016-01-08CVE-2015-5254: Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code…
PriorityP271critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
38.19%
98.4th percentile
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | >= 0 < 5.13.2+dfsg-1 | 5.13.2+dfsg-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is triggered via a crafted serialized Java Message Service (JMS) ObjectMessage object sent to Apache ActiveMQ broker; monitor for unexpected ObjectMessage deserialization activity on ActiveMQ brokers running versions 5.x before 5.13.0 ↗
- →Deserialization can occur at multiple broker entry points including the web console and STOMP object message transformation; monitor these interfaces for suspicious ObjectMessage payloads ↗
- →Applications calling ObjectMessage.getObject() are also vulnerable; instrument or monitor JVM deserialization at this call site for unexpected class loading ↗
- →Review the upstream patch commit for specific code changes that can inform detection signatures or class-restriction logic ↗
- →Upstream fix details and trusted-package allowlist configuration for ObjectMessage are documented at the ActiveMQ ObjectMessage page; use this to baseline expected deserialization behavior ↗
- ·A Java deserialization filtering agent (JEP 290 or third-party) can be used as a mitigation to restrict which classes are allowed to be deserialized; absence of such a filter is a prerequisite for exploitation ↗
- ·Exploitation requires the attacker to authenticate to the broker as a message producer AND the application must use JMS ObjectMessage; unauthenticated or non-ObjectMessage deployments are not directly affected ↗
- ·NiFi deployments using JMS processors with activemq-client prior to 5.15.3 (NiFi versions 0.1.0–1.5.0) are also affected via CVE-2018-1310; upgrade to NiFi 1.6.0 which bundles activemq-client 5.15.3 ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_apache9.8
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache NiFi JMS Deserialization issue
ghsa·2022-05-14·CVSS 9.8
CVE-2018-1310 [CRITICAL] CWE-502 Apache NiFi JMS Deserialization issue
Apache NiFi JMS Deserialization issue
Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
OSV
Apache NiFi JMS Deserialization issue
osv·2022-05-14·CVSS 9.8
CVE-2018-1310 [CRITICAL] Apache NiFi JMS Deserialization issue
Apache NiFi JMS Deserialization issue
Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
OSV
Improper Input Validation in Apache ActiveMQ
osv·2022-05-13
CVE-2015-5254 [CRITICAL] Improper Input Validation in Apache ActiveMQ
Improper Input Validation in Apache ActiveMQ
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
GHSA
Improper Input Validation in Apache ActiveMQ
ghsa·2022-05-13
CVE-2015-5254 [CRITICAL] CWE-20 Improper Input Validation in Apache ActiveMQ
Improper Input Validation in Apache ActiveMQ
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
OSV
CVE-2015-5254: Apache ActiveMQ 5
osv·2016-01-08·CVSS 9.8
CVE-2015-5254 [CRITICAL] CVE-2015-5254: Apache ActiveMQ 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Red Hat
ObjectMessage: unsafe deserialization
vendor_redhat·2015-12-08·CVSS 9.8
CVE-2015-5254 [CRITICAL] CWE-502 ObjectMessage: unsafe deserialization
ObjectMessage: unsafe deserialization
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Statement: A malicious message producer needs to authenticate to EAP in order to send messages. Also, the use of JMS ObjectMessage needs to be chosen by the developer of the application. Therefore this issue is rated as moderate.
Mitigation: If you do deploy a JMS publisher, and
Debian
CVE-2015-5254: activemq - Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be seri...
vendor_debian·2015·CVSS 9.8
CVE-2015-5254 [CRITICAL] CVE-2015-5254: activemq - Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be seri...
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Scope: local
bookworm: resolved (fixed in 5.13.2+dfsg-1)
bullseye: resolved (fixed in 5.13.2+dfsg-1)
sid: resolved (fixed in 5.13.2+dfsg-1)
trixie: resolved (fixed in 5.13.2+dfsg-1)
Apache
Apache nifi: CVE-2018-1310
vendor_apache·CVSS 9.8
CVE-2018-1310 Apache nifi: CVE-2018-1310
Apache nifi: CVE-2018-1310
Title: Potential Denial of Service in JMS Processors Published: 2018-04-08 Severity: Medium Products: Apache NiFi Affected Versions: 0.1.0 to 1.5.0 Fixed Versions: 1.6.0 Reporter: 圆珠笔 References CVE Record: CVE-2018-1310 NVD Record: CVE-2018-1310 Apache Jira Issue: NIFI-4870 GitHub Pull Request: 2469 Malicious JMS content could cause denial of service in impacted Processors. See ActiveMQ CVE-2015-5254 announcement for more information. NiFi 1.6.0 upgrades the activemq-client library to 5.15.3. Users running a prior release should upgrade to 1.6.0.
Severity: moderate
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5254 JMS ObjectMessage: unsafe deserialization
bugzilla·2015-12-14·CVSS 9.8
CVE-2015-5254 [CRITICAL] CVE-2015-5254 JMS ObjectMessage: unsafe deserialization
CVE-2015-5254 JMS ObjectMessage: unsafe deserialization
JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls.
This issue was fixed upstream in Apache ActiveMQ 5.13.0. Additionally, when using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look
Bugzilla
CVE-2015-5254 activemq: unsafe deserialization [fedora-all]
bugzilla·2015-12-14·CVSS 9.8
CVE-2015-5254 [CRITICAL] CVE-2015-5254 activemq: unsafe deserialization [fedora-all]
CVE-2015-5254 activemq: unsafe deserialization [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txthttp://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0489.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2035.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2036.htmlhttp://www.debian.org/security/2016/dsa-3524http://www.openwall.com/lists/oss-security/2015/12/08/6http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680https://issues.apache.org/jira/browse/AMQ-6013https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3Ehttp://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txthttp://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0489.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2035.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2036.htmlhttp://www.debian.org/security/2016/dsa-3524http://www.openwall.com/lists/oss-security/2015/12/08/6http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680https://issues.apache.org/jira/browse/AMQ-6013https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
2016-01-08
Published