Vulnerability Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Activemq Artemis | < 1.4.0 |
| Redhat | Jboss Enterprise Application Platform | 6.0.0 |
| Redhat | Enterprise Linux Server | 5.0 |
Related Weaknesses (CWE)
References
- http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzMailing ListVendor Advisory
- http://www.securityfocus.com/bid/93142Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1834Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1835Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1836Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1837Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3456Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3458Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1447Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1448Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1449Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1450Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1451Third Party Advisory
FAQ
What is CVE-2016-4978?
CVE-2016-4978 is a vulnerability with a CVSS score of 7.2 (HIGH). The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote auth...
How severe is CVE-2016-4978?
CVE-2016-4978 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-4978?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Activemq Artemis, Redhat Jboss Enterprise Application Platform, Redhat Enterprise Linux Server.