Deserialization of untrusted data in Apache ActiveMQ
Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Partial Red Hat: 6 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Why it matters now
Exploitation Active In CISA KEV since 2023-11-02CISA due date 2023-11-23Known ransomware use
EPSS 0.99992 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Apache ActiveMQ (Apache Software Foundation): 5.18.3, 5.17.6, 5.16.7 +1Apache ActiveMQ Legacy OpenWire Module (Apache Software Foundation): 5.18.3, 5.17.6, 5.16.7 +1+2 more productsRed Hat: 6 advisoriesRed Hat: 6 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | 5.18.0 to before 5.18.3; 5.17.0 to before 5.17.6; 5.16.0 to before 5.16.7; before 5.15.16 | 5.18.3, 5.17.6, 5.16.7, 5.15.16 | Patch available | CNA |
| Apache | Apache ActiveMQ Legacy OpenWire Module | 5.18.0 to before 5.18.3; 5.17.0 to before 5.17.6; 5.16.0 to before 5.16.7; 5.8.0 to before 5.15.16 | 5.18.3, 5.17.6, 5.16.7, 5.15.16 | Patch available | CNA |
| — | org.apache.activemq:activemq-client (Maven) | before 5.15.16 | 5.15.16 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-client (Maven) | 5.16.0 to before 5.16.7 | 5.16.7 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-client (Maven) | 5.17.0 to before 5.17.6 | 5.17.6 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-client (Maven) | 5.18.0 to before 5.18.3 | 5.18.3 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.8.0 to before 5.15.16 | 5.15.16 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.16.0 to before 5.16.7 | 5.16.7 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.17.0 to before 5.17.6 | 5.17.6 | Patch available | GHSA-crg9-44h2-xw35 |
| — | org.apache.activemq:activemq-openwire-legacy (Maven) | 5.18.0 to before 5.18.3 | 5.18.3 | Patch available | GHSA-crg9-44h2-xw35 |
- Apache ActiveMQ VendorApache Affected 5.18.0 to before 5.18.3; 5.17.0 to before 5.17.6; 5.16.0 to before 5.16.7; before 5.15.16 Fixed in 5.18.3, 5.17.6, 5.16.7, 5.15.16 Patch available CNA
- Apache ActiveMQ Legacy OpenWire Module VendorApache Affected 5.18.0 to before 5.18.3; 5.17.0 to before 5.17.6; 5.16.0 to before 5.16.7; 5.8.0 to before 5.15.16 Fixed in 5.18.3, 5.17.6, 5.16.7, 5.15.16 Patch available CNA
- org.apache.activemq:activemq-client (Maven) Vendor— Affected before 5.15.16 Fixed in 5.15.16 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.16.0 to before 5.16.7 Fixed in 5.16.7 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.17.0 to before 5.17.6 Fixed in 5.17.6 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.18.0 to before 5.18.3 Fixed in 5.18.3 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.8.0 to before 5.15.16 Fixed in 5.15.16 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.16.0 to before 5.16.7 Fixed in 5.16.7 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.17.0 to before 5.17.6 Fixed in 5.17.6 Patch available GHSA-crg9-44h2-xw35
- org.apache.activemq:activemq-openwire-legacy (Maven) Vendor— Affected 5.18.0 to before 5.18.3 Fixed in 5.18.3 Patch available GHSA-crg9-44h2-xw35
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* | before 5.15.16; 5.16.0 to before 5.16.7; 5.17.0 to before 5.17.6; 5.18.0 to before 5.18.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* | before 5.15.16; 5.16.0 to before 5.16.7; 5.17.0 to before 5.17.6; 5.18.0 to before 5.18.3 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:* Versions before 5.15.16; 5.16.0 to before 5.16.7; 5.17.0 to before 5.17.6; 5.18.0 to before 5.18.3 Vulnerable ·Apache
- cpe:2.3:a:apache:activemq_legacy_openwire_module:*:*:*:*:*:*:*:* Versions before 5.15.16; 5.16.0 to before 5.16.7; 5.17.0 to before 5.17.6; 5.18.0 to before 5.18.3 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Apache ActiveMQ (Apache Software Foundation) Fixed in 5.18.3, 5.17.6, 5.16.7, 5.15.16
- Fix · CNA Apache ActiveMQ Legacy OpenWire Module (Apache Software Foundation) Fixed in 5.18.3, 5.17.6, 5.16.7, 5.15.16
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-client (Maven) Fixed in 5.15.16 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-client (Maven) Fixed in 5.16.7 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-client (Maven) Fixed in 5.17.6 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-client (Maven) Fixed in 5.18.3 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.15.16 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.16.7 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.17.6 Advisory →
- Fix · GHSA-crg9-44h2-xw35 org.apache.activemq:activemq-openwire-legacy (Maven) Fixed in 5.18.3 Advisory →
Red Hat 6 advisories
- RHSA-2023:7247 Released 2023-11-15 · Red Hat rating CriticalRed Hat Fuse 7.12.1 release and security update
- Red Hat Fuse 7.12.1
- RHSA-2023:6879 Released 2023-11-09 · Red Hat rating CriticalRed Hat AMQ Broker 7.11.4 release and security update
- AMQ Broker 7.11.4
- RHSA-2023:6878 Released 2023-11-09 · Red Hat rating CriticalRed Hat AMQ Broker 7.10.5 release and security update
- AMQ Broker 7.10.5
Show 3 more Red Hat advisories
- RHSA-2023:6877 Released 2023-11-09 · Red Hat rating Criticalsecurity update jboss-amq-6/amq63-openshift container image
- AMQ 6.3 openshift container image
- RHSA-2023:6866 Released 2023-11-09 · Red Hat rating Criticaljboss-amq-6-amq63-openshift-container security update
- Middleware RHEL 7 Containers for OpenShift jboss-amq-6/amq63-openshift
- RHSA-2023:6849 Released 2023-11-09 · Red Hat rating CriticalRed Hat JBoss Fuse/A-MQ Fuse 6.3 R20 HF1 security and bug fix update
- Red Hat Fuse/AMQ 6.3.20
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| AMQ 6.3 openshift container image | Fixed | RHSA-2023:6877 |
| AMQ Broker 7.10.5 | Fixed | RHSA-2023:6878 |
| AMQ Broker 7.11.4 | Fixed | RHSA-2023:6879 |
| Middleware RHEL 7 Containers for OpenShift | Fixed | RHSA-2023:6866 |
| Red Hat Fuse 7.12.1 | Fixed | RHSA-2023:7247 |
| Red Hat Fuse/AMQ 6.3.20 | Fixed | RHSA-2023:6849 |
Timeline
- 2023-11-02 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-46604
- 2026-10-03 Alias added: GHSA-crg9-44h2-xw35
References
Advisory 5
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
- https://security.netapp.com/advisory/ntap-20231110-0010/
- http://seclists.org/fulldisclosure/2024/Apr/18
- https://nvd.nist.gov/vuln/detail/CVE-2023-46604
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46604
Other 15
- https://www.openwall.com/lists/oss-security/2023/10/27/5
- https://lists.debian.org/debian-lts-announce/2023/11/msg00013.html
- https://github.com/apache/activemq/pull/1098
- https://github.com/apache/activemq/commit/22442b2385b1000312aec3d19e510131d595a5fc
- https://github.com/apache/activemq/commit/80089f9f476afab7d976f5fc37c5ab4aa0c2139d
- https://github.com/apache/activemq/commit/958330df26cf3d5cdb63905dc2c6882e98781d8f
- https://github.com/apache/activemq/commit/9905e2a5bf9862a049f94ce0a2465b0c7ad52436
- https://github.com/apache/activemq/commit/d0ccdd31544ada83185554c87c7aa141064020f0
- https://security.netapp.com/advisory/ntap-20231110-0010
- https://lists.debian.org/debian-lts-announce/2024/10/msg00027.html
- https://issues.apache.org/jira/browse/AMQ-9370
- https://github.com/apache/activemq
- https://activemq.apache.org/security-advisories.data/CVE-2023-46604
- http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/10/27/5
More Apache Activemq vulnerabilities
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
- TI-2021-04444 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-46604 · CVE Program
- CVE-2023-46604 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-crg9-44h2-xw35 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-46604 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences