Back to search
CVE-2016-4978
Published: Sep 27, 2016
Modified: Aug 6, 2024
PUBLISHED
Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
93142
vdb-entry
x_refsource_BID
RHSA-2018:1448
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1836
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1835
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1449
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1450
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3458
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1837
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1834
vendor-advisory
x_refsource_REDHAT
[activemq-users] 20160923 [CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability
mailing-list
x_refsource_MLIST
RHSA-2018:1451
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3455
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3456
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3454
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1447
vendor-advisory
x_refsource_REDHAT
[activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26118
mailing-list
x_refsource_MLIST
[activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now