Description
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qpid-cpp | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.qpid:qpid-jms-client | < 0.10.0 | 0.10.0 | GHSA-f38p-mq64-h784 |
References
- 91537 vdb-entry
- 20160702 [SECURITY] CVE-2016-4974: Apache Qpid: deserialization of untrusted input while using JMS ObjectMessage mailing-list
- https://issues.apache.org/jira/browse/QPIDJMS-188
- 1036239 vdb-entry
- http://qpid.apache.org/components/jms/security-0-x.html
- http://packetstormsecurity.com/files/137749/Apache-Qpid-Untrusted-Input-Deserialization.html
- http://qpid.apache.org/components/jms/security.html