Описание
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
Меры по смягчению последствий
Configure a restrictive deserialization-allow-list on every pooled-connection-factory resource. For example, if your MDBs only expect to receive objects of type com.yourapp.OrderEvent, set the allow-list to "com.yourapp". This switches ObjectInputStreamWithClassLoader from "allow everything" to "deny by default, allow only listed classes." With this in place, even if an attacker injects a malicious ObjectMessage through any vector, the deserialization of gadget chain classes is blocked.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | artemis-server | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | artemis-core-client | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | artemis-jms-client | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | artemis-server | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | undertow-core | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | artemis-core-client | Affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | artemis-jms-client | Affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | artemis-server | Affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | undertow-core | Affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | wildfly-messaging-activemq-subsystem | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
EPSS
8.8 High
CVSS3