CVE-2015-5254: Improper Input Validation in Apache ActiveMQ
Summary
CVE-2015-5254: Improper Input Validation in Apache ActiveMQ. Affects org.apache.activemq:activemq-client across 2 version ranges.
>= 5.0.0, < 5.11.3
>= 5.12.0, < 5.12.2
Fixed in 5.11.3 or 5.12.2, depending on the release line you run. How to fix ↓
Also tracked for
- activemq · Debian:11
The same CVE-2015-5254 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) specification. It provides reliable messaging between distributed applications, allowing them to communicate and exchange data. The 'org.apache.activemq:activemq-client' package is a client library for interacting with the ActiveMQ broker. This vulnerability affects versions prior to 5.13.0 of the package.
Vulnerability Detail
The vulnerability (CVE-2015-5254) in Apache ActiveMQ 5.x allows remote attackers to execute arbitrary code by exploiting improper input validation. Specifically, the broker does not restrict the classes that can be serialized, making it possible for an attacker to craft a serialized Java Message Service (JMS) ObjectMessage object that contains malicious code. When this object is deserialized by the broker, the code is executed, leading to arbitrary code execution on the server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.0.0, < 5.11.35.11.3 -
>= 5.12.0, < 5.12.25.12.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to Apache ActiveMQ 5.13.0 or later.
Conclusion
The vulnerability (CVE-2015-5254) in Apache ActiveMQ 5.x allows remote code execution by exploiting improper input validation. To mitigate this risk, it is essential to upgrade to Apache ActiveMQ version 5.13.0 or later. This version includes the necessary restrictions on serialized classes, preventing the execution of arbitrary code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-client →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates communication between distributed applications using the Java Message Service (JMS) specification.
This vulnerability allows remote attackers to execute arbitrary code on the server running Apache ActiveMQ, potentially leading to unauthorized access, data breaches, or disruption of services.
To fix this vulnerability, you should upgrade to Apache ActiveMQ version 5.13.0 or later. This version includes the necessary restrictions on serialized classes to prevent the execution of arbitrary code.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to Apache ActiveMQ 5.13.0 or later.
You can find more information about this vulnerability in the CVE-2015-5254 entry or by contacting the Apache ActiveMQ community.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-client.
