CVE-2022-41678: Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
First published: Tue Nov 28 2023(Updated: )
Apache ActiveMQ could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Jolokia component. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Secure Proxy | <=6.0.3 | |
| IBM Secure Proxy | <=6.1.0 | |
| Apache ActiveMQ | <5.16.6 | |
| Apache ActiveMQ | >=5.17.0<5.17.4 | |
| maven/org.apache.activemq:apache-activemq | >=5.17.0<5.17.4 | 5.17.4 |
| maven/org.apache.activemq:apache-activemq | <5.16.6 | 5.16.6 |
| debian/activemq | <=5.16.1-1<=5.17.2+dfsg-2 | 5.17.6+dfsg-1 |
| redhat/activemq | <5.16.6 | 5.16.6 |
| redhat/activemq | <5.17.4 | 5.17.4 |
| redhat/activemq | <5.18.0 | 5.18.0 |
| redhat/activemq | <6.0.0 | 6.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/272445
- https://www.ibm.com/support/pages/node/7142038 (Advisory)
- https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
- https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
- https://security.netapp.com/advisory/ntap-20240216-0004/
- https://www.openwall.com/lists/oss-security/2023/11/28/1
- https://nvd.nist.gov/vuln/detail/CVE-2022-41678
- http://www.openwall.com/lists/oss-security/2023/11/28/1
- https://github.com/apache/activemq/pull/958
- https://github.com/apache/activemq/commit/6120169e563b55323352431dfe9ac67a8b4de6c2
- https://security.netapp.com/advisory/ntap-20240216-0004
- https://github.com/apache/activemq/commit/5c8d457d9
- https://github.com/apache/activemq/commit/bf65929fd
- https://github.com/apache/activemq/commit/d8ce1d9ff
- https://github.com/advisories/GHSA-53v4-42fg-g287 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2022-41678
- https://security-tracker.debian.org/tracker/CVE-2022-41678
- https://access.redhat.com/errata/RHSA-2024:2944
- https://access.redhat.com/errata/RHSA-2024:2945
- https://access.redhat.com/errata/RHSA-2024:3354
- https://bugzilla.redhat.com/show_bug.cgi?id=2252185
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41678
- https://ubuntu.com/security/CVE-2022-41678
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-41678.
What is the title of this vulnerability?
The title of this vulnerability is Apache ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform…
What is the severity level of CVE-2022-41678?
The severity level of CVE-2022-41678 is not specified in the provided information.
How does the vulnerability in Apache ActiveMQ impact users?
The vulnerability in Apache ActiveMQ allows authenticated users to potentially trigger arbitrary code execution through Jolokia.
Which version of Apache ActiveMQ is affected by CVE-2022-41678?
CVE-2022-41678 affects Apache ActiveMQ versions 5.17.0 to 5.17.4 and 5.16.6.
How can I fix the vulnerability in Apache ActiveMQ?
To fix the vulnerability in Apache ActiveMQ, update to version 5.17.4 (for versions 5.17.0 to 5.17.4) or version 5.16.6 (for version 5.16.6).
Where can I find more information about CVE-2022-41678?
More information about CVE-2022-41678 can be found in the provided references: [Link 1](https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt), [Link 2](https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl), [Link 3](http://www.openwall.com/lists/oss-security/2023/11/28/1).
- collector/oss-sec
- alias/CVE-2022-41678
- agent/author
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/severity
- agent/title
- agent/weakness
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-53v4-42fg-g287
- collector/nvd-cve
- collector/github-advisory
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/description
- agent/references
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- vendor/ibm
- canonical/ibm secure proxy
- version/ibm secure proxy/6.0.3
- version/ibm secure proxy/6.1.0
- vendor/apache
- canonical/apache activemq
- version/apache activemq/5.17.0
- package-manager/maven
- package-manager/debian
- package-manager/redhat