Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +14 | 1.1.0-18.SP21_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-jdbc-store | 1.5.5.008-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-antlr | 2.7.7-35.redhat_7.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-beanutils | 1.9.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-cli | 1.3.1-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.5.0-2.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.12-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-mime4j | 0.6.0-2.redhat_6.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1.5.0-5.redhat_1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.2-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-azure-storage | 5.0.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.56.0-4.redhat_2.2.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-codehaus-jackson +4 | 1.9.13-7.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-commons-logging-jboss-logmanager | 1.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-cryptacular | 1.2.0-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-cxf-xjc-dv +5 | 3.0.5-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-ecj | 4.6.1-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.0.1-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-concurrent | 1.0.0-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-2.b08_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jaf | 1.1.1-21.redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-javamail | 1.5.6-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.2.12-2.SP4_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-glassfish-json | 1.0.4-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 20.0.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-h2database | 1.4.193-4.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.0.14-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-hibernate-commons-annotations | 5.0.1-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-jpa-2.1-api | 1.0.0-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.5.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 5.3.5-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-asyncclient | 4.1.2-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.2-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-core | 4.4.4-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-infinispan +5 | 8.2.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +9 | 1.3.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +8 | 2.8.9-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.5.4-2.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jansi | 1.16.0-5.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-java-classmate | 1.3.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-javassist | 3.20.0-2.GA_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jaxbintros | 1.0.2-19.GA_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jaxen | 1.1.6-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.2.4-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-aesh | 0.66.19-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-annotations-api_1.2_spec | 1.0.0-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-classfilewriter | 1.2.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-concurrency-api_1.0_spec | 1.0.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-connector-api_1.7_spec | 1.0.0-5.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-dmr | 1.4.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.7-1.GA_redhat_1.ep7.el6 | RHSA-2017:3458, RHSA-2017:1837 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-api_3.2_spec +4 | 1.0.0-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb3-ext-api | 2.2.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.9-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-iiop-client +1 | 1.0.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-invocation | 1.5.0-5.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxb-api_2.2_spec | 1.0.4-6.Final_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxrpc-api_1.1_spec | 1.0.1-8.Final_redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxws-api_2.2_spec | 2.0.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jms-api_2.0_spec | 1.0.1-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.2_spec | 2.2.13-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec +2 | 1.0.1-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.7-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 10.0.2-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.5.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jboss-openjdk-orb | 8.0.8-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.23-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.0-8.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-saaj-api_1.3_spec | 1.0.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-seam-int | 7.0.0-5.GA_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-xacml | 2.0.8-16.Final_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +18 | 1.0.3-4.Final_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-transaction-spi | 7.6.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-vfs | 3.2.12-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-websocket-api_1.1_spec | 1.1.1-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-2.2-api | 2.4.0-2.SP1_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.4.6-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common-tools | 1.2.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.1.9-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.1.4-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.3.8-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.13-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jgroups-azure | 1.1.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-joda-time | 2.9.7-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.8.3-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jul-to-slf4j-stub | 1.0.1-6.Final_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-mustache-java +1 | 0.9.4-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.5.30-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-neethi | 3.0.3-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-netty-xnio-transport | 0.1.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-objectweb-asm | 3.3.1-14.redhat_13.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-picketbox-commons | 1.0.0-3.final_redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-resteasy +17 | 3.0.19-6.SP4_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-shibboleth-java-support | 7.1.1-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-slf4j +3 | 1.7.22-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.17.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-staxmapper | 1.3.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-sun-saaj-1.3-impl | 1.3.16-16.SP1_redhat_6.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-sun-ws-metadata-2.0-api | 1.0.0-6.MR1_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-taglibs-standard-impl +3 | 1.2.6-1.RC1_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-txw2 +7 | 2.2.11-10.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow +2 | 2.0.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-vdx +2 | 1.1.6-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-weld-core +3 | 2.4.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.7-4.GA_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-wildfly-client-config | 1.0.0-7.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.2.0-10.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-discovery +1 | 1.0.0-9.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.0.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.7-3.GA_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +2 | 1.0.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl-linux | 1.0.2-13.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-web-console-eap | 2.8.30-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 5.0.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.1.10-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.0.8-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-xom | 1.2.10-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-12.redhat_6.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-26.SP24_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.20-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.20-1.Final_redhat_1.ep6.el6 | RHSA-2018:1451 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | lucene-solr | 3.6.2-8.redhat_9.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:artemis-pom | < 1.4.0 | 1.4.0 | GHSA-r9vv-xj4w-g8m8 |
Advisories 11
- WID-SEC-2026-2752 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2018:1451 Red Hat Security Advisory: eap6-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1448 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3458 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3455 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3454 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:1837 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1835 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1834 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6 Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf
- 93142 vdb-entry
- RHSA-2018:1448 vendor-advisory
- RHSA-2017:1836 vendor-advisory
- RHSA-2017:1835 vendor-advisory
- RHSA-2018:1449 vendor-advisory
- RHSA-2018:1450 vendor-advisory
- RHSA-2017:3458 vendor-advisory
- RHSA-2017:1837 vendor-advisory
- RHSA-2017:1834 vendor-advisory
- [activemq-users] 20160923 [CVE-2016-4978] Apache ActiveMQ Artemis: Deserialization of untrusted input vunerability mailing-list
- RHSA-2018:1451 vendor-advisory
- RHSA-2017:3455 vendor-advisory
- RHSA-2017:3456 vendor-advisory
- RHSA-2017:3454 vendor-advisory
- RHSA-2018:1447 vendor-advisory
- [activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978 mailing-list
- [activemq-issues] 20190529 [jira] [Closed] (ARTEMIS-2362) activemq-artemis-native-1.0.0.jar is vulnerable to CVE-2016-4978 mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26118 mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117 mailing-list