CVE-2023-46604: Deserialization of Untrusted Data

October 27, 2023 (updated November 28, 2023)

Apache ActiveMQ is vulnerable to Remote Code Execution. The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

References

www.openwall.com/lists/oss-security/2023/10/27/5
activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
nvd.nist.gov/vuln/detail/CVE-2023-46604

Detect and mitigate CVE-2023-46604 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →