The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2)…
Priority MEDIUM 41CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Why it matters now
EPSS 0.06879 94th percentileScored 2026-11-07
Fix Partial org.apache.activemq:artemis-pom (Maven): 1.4.0Red Hat: 13 advisoriesRed Hat: 10 fixed, 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.activemq:artemis-pom (Maven) | before 1.4.0 | 1.4.0 | Patch available | GHSA-r9vv-xj4w-g8m8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.activemq:artemis-pom (Maven) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-r9vv-xj4w-g8m8
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | Apache |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | Red Hat |
- cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Apache
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-r9vv-xj4w-g8m8 org.apache.activemq:artemis-pom (Maven) Fixed in 1.4.0 Advisory →
Red Hat 13 advisories
- RHSA-2018:1451 Released 2018-05-14 · Red Hat rating Importanteap6-jboss-ec2-eap security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.20-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.20-1.Final_redhat_1.ep6.el6
- RHSA-2018:1449 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
- RHSA-2018:1450 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
Show 10 more Red Hat advisories
- RHSA-2018:1448 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el7 +47
- RHSA-2018:1447 Released 2018-05-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.20 security update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Importanteap7-jboss-ec2-eap security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
- RHSA-2017:3455 Released 2017-12-13 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.0 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
- RHSA-2017:3454 Released 2017-12-13 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.0 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
- RHSA-2017:3456 Released 2017-12-13 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.0 security update
- Red Hat JBoss EAP 7.1
- RHSA-2017:1837 Released 2017-07-31 · Red Hat rating Importanteap7-jboss-ec2-eap security update
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.7-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.7-1.GA_redhat_1.ep7.el6
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.7-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.7-1.GA_redhat_1.ep7.el7
- RHSA-2017:1834 Released 2017-07-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-18.SP21_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-18.SP21_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-18.SP21_redhat_1.1.ep7.el6 +47
- RHSA-2017:1835 Released 2017-07-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-18.SP21_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-18.SP21_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-18.SP21_redhat_1.1.ep7.el7 +47
- RHSA-2017:1836 Released 2017-07-31 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.0.7
- Red Hat JBoss EAP 7.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Portal 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat JBoss EAP 7.0 | Fixed | RHSA-2017:1836 |
| Red Hat JBoss EAP 7.1 | Fixed | RHSA-2017:3456 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2018:1447 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2018:1450 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2018:1449, RHSA-2018:1451 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2018:1448 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server | Fixed | RHSA-2017:1834, RHSA-2017:1837 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server | Fixed | RHSA-2017:1835, RHSA-2017:1837 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server | Fixed | RHSA-2017:3454, RHSA-2017:3458 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server | Fixed | RHSA-2017:3455, RHSA-2017:3458 |
Not affected: 4 products
- Red Hat BPM Suite 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss Fuse 6
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2016-4978
- 2026-10-03 Alias added: GHSA-r9vv-xj4w-g8m8
- 2026-11-05 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat
References
Advisory 16
- https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf
- RHSA-2018:1448
- RHSA-2017:1836
- RHSA-2017:1835
- RHSA-2018:1449
- RHSA-2018:1450
- RHSA-2017:3458
- RHSA-2017:1837
- RHSA-2017:1834
- [activemq-users] 20160923 [CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability
- RHSA-2018:1451
- RHSA-2017:3455
- RHSA-2017:3456
- RHSA-2017:3454
- RHSA-2018:1447
- https://nvd.nist.gov/vuln/detail/CVE-2016-4978
Other 10
- [activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978
- [activemq-issues] 20190529 [jira] [Closed] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26118
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117
- https://web.archive.org/web/20210123172653/http://www.securityfocus.com/bid/93142
- https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2@%3Cissues.activemq.apache.org%3E
- https://github.com/apache/activemq-artemis
Sources
- CVE-2016-4978 · CVE Program
- CVE-2016-4978 · NVD
- FIRST EPSS
- GHSA-r9vv-xj4w-g8m8 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-4978 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences