Latest critical severity vulnerabilities for "apache activemq" 5.16.0

Where

AND

Sort:

maven/org.apache.activemq:activemq-openwire-legacyApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

Risk 95

Severity

Exploited

Buffer Overflow, Use After Free

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

1 / 7

Source: CISA

First published (updated )

CVE-2023-46604

redhat/xstreamXStream is vulnerable to a Remote Command Execution attack

Risk 86

Severity

9.9

OS Command Injection, Code Injection

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

A flaw was found in xstream. A remote attacker, who has sufficient rights, can execute commands of the host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4

First published (updated )

CVE-2021-21345

redhat/xstreamA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Risk 69

Severity

9.1

SSRF

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Last updated 22 August 2024

1 / 3

Source: Ubuntu

First published (updated )

CVE-2021-21342

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

Risk 89

Severity

9.8

Malicious File Upload

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4

First published (updated )

CVE-2021-21350

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

Risk 89

Severity

9.8

Malicious File Upload

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in xstream. A remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4

First published (updated )

CVE-2021-21346

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

Risk 89

Severity

9.8

Malicious File Upload

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 4

First published (updated )

CVE-2021-21347

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

Risk 89

Severity

9.8

Malicious File Upload

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

1 / 4

First published (updated )

CVE-2021-21344

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

Risk 75

Severity

9.1

Malicious File Upload

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Last updated 22 August 2024

1 / 3

Source: Ubuntu

First published (updated )

CVE-2021-21351

redhat/xstreamRemote Code Execution in XStream

Risk 83

Severity

9.3

OS Command Injection

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

1 / 5

Remedy

Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach ```java XStream xstream = new XStream(); XStream.setupDefaultSecurity(xstream); xstream.allowTypesByWildcard(new String[] {"com.misc.classname"}) ``` Deny list for XStream 1.4.13 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Deny list for XStream 1.4.7 -> 1.4.12 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Deny list for versions prior to XStream 1.4.7 ```java xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type)); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW); ```

First published (updated )

CVE-2020-26217

Trending

maven/org.apache.activemq:activemq-openwire-legacyApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

redhat/xstreamXStream is vulnerable to a Remote Command Execution attack

redhat/xstreamA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

redhat/xstreamXStream is vulnerable to an Arbitrary Code Execution attack

redhat/xstreamRemote Code Execution in XStream

Remedy

Company

Resources

Contact