netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-crg9-44h2-xw35
GHSA-crg9-44h2-xw35
This commit is contained in:
advisory-database[bot]
2023-10-30 20:10:00 +00:00
parent 658d68e980
commit 8f5ebea448
2 changed files with 206 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json
+206
View File
@@ -0,0 +1,206 @@
{
"schema_version": "1.4.0",
"id": "GHSA-crg9-44h2-xw35",
"modified": "2023-10-30T20:08:40Z",
"published": "2023-10-27T15:30:20Z",
"aliases": [
"CVE-2023-46604"
],
"summary": "Apache ActiveMQ is vulnerable to Remote Code Execution",
"details": "Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.16.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.17.0"
},
{
"fixed": "5.17.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.18.0"
},
{
"fixed": "5.18.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.8.0"
},
{
"fixed": "5.15.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.16.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.17.0"
},
{
"fixed": "5.17.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.18.0"
},
{
"fixed": "5.18.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/pull/1098/commits/3eaf3107f4fb9a3ce7ab45c175bfaeac7e866d5b"
},
{
"type": "WEB",
"url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604"
},
{
"type": "WEB",
"url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/AMQ-9370"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/27/5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2023-10-30T20:08:40Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-crg9-44h2-xw35",
"modified": "2023-10-27T15:30:20Z",
"published": "2023-10-27T15:30:20Z",
"aliases": [
"CVE-2023-46604"
],
"details": "Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604"
},
{
"type": "WEB",
"url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"
}
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}