Description
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Artemis in EAP 7 | 7.3.9.GA, 7.4.0.GA | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-hornetq +3 | 2.4.8-1.Final_redhat_00001.1.el7eap | RHSA-2022:0401, RHSA-2022:0400 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.13-1.SP2_redhat_00001.1.el7eap | RHSA-2022:0401, RHSA-2022:0400 |
Advisories 2
- RHSA-2022:0401 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:0400 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026