Описание
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 5.13.2+dfsg-2 |
| esm-apps-legacy/xenial | not-affected | 5.13.2+dfsg-2 |
| esm-apps/xenial | not-affected | 5.13.2+dfsg-2 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [5.6.0+dfsg-1+deb7u2build0.14.04.1]] |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needed |
| trusty | released | 5.6.0+dfsg-1+deb7u2build0.14.04.1 |
| trusty/esm | DNE | trusty was released [5.6.0+dfsg-1+deb7u2build0.14.04.1] |
| upstream | released | 5.13.0 |
| vivid | ignored | end of life |
Показывать по
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that c ...
Уязвимость службы сообщений Java (JMS) программной платформы Apache ActiveMQ, позволяющая нарушителю выполнить произвольный код
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3