CVE-2023-46604
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
How to fix
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Nov 23, 2023- apache activemq5.15.16, 5.16.7, 5.17.6, 5.18.3 or later
- apache activemq_legacy_openwire_module5.15.16, 5.16.7, 5.17.6, 5.18.3 or later
- org.apache.activemq:activemq-client5.15.16, 5.16.7, 5.17.6, 5.18.3 or later
- org.apache.activemq:activemq-openwire-legacy5.15.16, 5.16.7, 5.17.6, 5.18.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache activemq | v < 5.15.16, 5.16.0 ≤ v < 5.16.7, 5.17.0 ≤ v < 5.17.6, 5.18.0 ≤ v < 5.18.3 | 5.15.16, 5.16.7, 5.17.6, 5.18.3 |
| apache activemq_legacy_openwire_module | v < 5.15.16, 5.16.0 ≤ v < 5.16.7, 5.17.0 ≤ v < 5.17.6, 5.18.0 ≤ v < 5.18.3 | 5.15.16, 5.16.7, 5.17.6, 5.18.3 |
| debian debian_linux | 10.0, 11.0 | — |
| netapp e-series_santricity_unified_manager | No range specified | — |
| netapp e-series_santricity_web_services_proxy | No range specified | — |
| netapp santricity_storage_plugin | No range specified | — |
| org.apache.activemq:activemq-clientMaven | v < 5.15.16, 5.16.0 ≤ v < 5.16.7, 5.17.0 ≤ v < 5.17.6, 5.18.0 ≤ v < 5.18.3 | 5.15.16, 5.16.7, 5.17.6, 5.18.3 |
| org.apache.activemq:activemq-openwire-legacyMaven | 5.8.0 ≤ v < 5.15.16, 5.16.0 ≤ v < 5.16.7, 5.17.0 ≤ v < 5.17.6, 5.18.0 ≤ v < 5.18.3 | 5.15.16, 5.16.7, 5.17.6, 5.18.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.