CVE-2016-4974: Improper Input Validation in Apache Qpid AMQP 0-x JMS
Summary
CVE-2016-4974: Improper Input Validation in Apache Qpid AMQP 0-x JMS. Affects org.apache.qpid:qpid-jms-client versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid AMQP 0-x JMS client is a Java Message Service (JMS) client library that allows applications to communicate using the Advanced Message Queuing Protocol (AMQP). It provides a reliable and efficient way to exchange messages between distributed systems. The vulnerability affects versions before 6.0.4 and 0.10.0 of the client library. The library does not properly validate input, allowing remote authenticated users with message-sending permissions to deserialize arbitrary objects and execute arbitrary code. This vulnerability can be exploited by crafting a serialized object in a JMS ObjectMessage and handling it with the getObject function.
Vulnerability Detail
The vulnerability in Apache Qpid AMQP 0-x JMS client and JMS (AMQP 1.0) allows remote authenticated users to execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage. The library does not restrict the use of classes available on the classpath, enabling the deserialization of arbitrary objects. This can lead to remote code execution and potential compromise of the affected system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the secure versions mentioned above.
Conclusion
The vulnerability in Apache Qpid AMQP 0-x JMS client and JMS (AMQP 1.0) allows remote authenticated users to execute arbitrary code by exploiting the deserialization of arbitrary objects. To mitigate this risk, it is crucial to upgrade to the secure versions mentioned above. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:qpid-jms-client →
FAQ
Apache Qpid AMQP 0-x JMS client is a Java library that enables applications to communicate using the Advanced Message Queuing Protocol (AMQP). It provides a reliable and efficient way to exchange messages between distributed systems.
The vulnerability allows remote authenticated users to execute arbitrary code by exploiting the deserialization of arbitrary objects. This can lead to remote code execution and potential compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to version 6.0.4 or later for Apache Qpid AMQP 0-x JMS client, and version 0.10.0 or later for JMS (AMQP 1.0). These versions include the necessary fixes to properly validate input and prevent the deserialization of arbitrary objects.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the secure versions mentioned above.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
