From 8f5ebea4482979c31ee09b726bc1eb6f3cc47b45 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 30 Oct 2023 20:10:00 +0000 Subject: [PATCH] Publish Advisories GHSA-crg9-44h2-xw35 GHSA-crg9-44h2-xw35 --- .../GHSA-crg9-44h2-xw35.json | 206 ++++++++++++++++++ .../GHSA-crg9-44h2-xw35.json | 38 ---- 2 files changed, 206 insertions(+), 38 deletions(-) create mode 100644 advisories/github-reviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json delete mode 100644 advisories/unreviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json diff --git a/advisories/github-reviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json b/advisories/github-reviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json new file mode 100644 index 00000000000..be779cef92a --- /dev/null +++ b/advisories/github-reviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json @@ -0,0 +1,206 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-crg9-44h2-xw35", + "modified": "2023-10-30T20:08:40Z", + "published": "2023-10-27T15:30:20Z", + "aliases": [ + "CVE-2023-46604" + ], + "summary": "Apache ActiveMQ is vulnerable to Remote Code Execution", + "details": "Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.15.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.16.0" + }, + { + "fixed": "5.16.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.17.0" + }, + { + "fixed": "5.17.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.18.0" + }, + { + "fixed": "5.18.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.8.0" + }, + { + "fixed": "5.15.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.16.0" + }, + { + "fixed": "5.16.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.17.0" + }, + { + "fixed": "5.17.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.18.0" + }, + { + "fixed": "5.18.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" + }, + { + "type": "WEB", + "url": "https://github.com/apache/activemq/pull/1098/commits/3eaf3107f4fb9a3ce7ab45c175bfaeac7e866d5b" + }, + { + "type": "WEB", + "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604" + }, + { + "type": "WEB", + "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/AMQ-9370" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/10/27/5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2023-10-30T20:08:40Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json b/advisories/unreviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json deleted file mode 100644 index 3d796a36bdb..00000000000 --- a/advisories/unreviewed/2023/10/GHSA-crg9-44h2-xw35/GHSA-crg9-44h2-xw35.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-crg9-44h2-xw35", - "modified": "2023-10-27T15:30:20Z", - "published": "2023-10-27T15:30:20Z", - "aliases": [ - "CVE-2023-46604" - ], - "details": "Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. \n\nUsers are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46604" - }, - { - "type": "WEB", - "url": "https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file