CVE-2023-46604 (Critical) detected in activemq-all-5.10.0.jar

[mend-bolt-for-github]

CVE-2023-46604 - Critical Severity Vulnerability

Vulnerable Library - activemq-all-5.10.0.jar

Puts together an ActiveMQ jar bundle

Path to dependency file: /pom.xml

Path to vulnerable library: /20201127105057_JYADOJ/downloadResource_XKWWQX/20201127105931/activemq-all-5.10.0.jar

Dependency Hierarchy:

• ❌ activemq-all-5.10.0.jar (Vulnerable Library)

Found in HEAD commit: 26994796809a3a8687a975e3361495d457afe47c

Found in base branch: master

Vulnerability Details

The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.

Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.

Publish Date: 2023-10-27

URL: CVE-2023-46604

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

Release Date: 2023-10-27

Fix Resolution: 5.15.16

---

Step up your Open Source Security Game with Mend here