Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1379207 - (CVE-2016-4978) CVE-2016-4978 Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability
CVE-2016-4978 Apache ActiveMQ Artemis: Deserialization of untrusted input vul...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160923,repor...
: Security
Depends On: 1444234 1444235 1472036
Blocks: 1393642 1474181 1520314
  Show dependency tree / graph
 
Reported: 2016-09-26 00:00 EDT by Hooman Broujerdi
Modified: 2018-10-19 17:37 EDT (History)
55 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1834 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6 2017-07-31 14:59:10 EDT
Red Hat Product Errata RHSA-2017:1835 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7 2017-07-31 14:58:11 EDT
Red Hat Product Errata RHSA-2017:1836 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.0.7 2017-07-31 14:47:54 EDT
Red Hat Product Errata RHSA-2017:1837 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-07-31 15:20:11 EDT
Red Hat Product Errata RHSA-2017:3454 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 17:48:09 EST
Red Hat Product Errata RHSA-2017:3455 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 17:57:25 EST
Red Hat Product Errata RHSA-2017:3456 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 7.1.0 security update 2017-12-13 17:31:03 EST
Red Hat Product Errata RHSA-2017:3458 normal SHIPPED_LIVE Important: eap7-jboss-ec2-eap security update 2017-12-13 18:26:13 EST
Red Hat Product Errata RHSA-2018:1447 None None None 2018-05-14 16:15 EDT
Red Hat Product Errata RHSA-2018:1448 None None None 2018-05-14 16:35 EDT
Red Hat Product Errata RHSA-2018:1449 None None None 2018-05-14 16:38 EDT
Red Hat Product Errata RHSA-2018:1450 None None None 2018-05-14 16:42 EDT
Red Hat Product Errata RHSA-2018:1451 None None None 2018-05-14 16:50 EDT

  None (edit)
Description Hooman Broujerdi 2016-09-26 00:00:25 EDT 
A class implementing the Serializable interface is free to implement
the “readObject(java.io.ObjectInputStream
in)” method however it chooses. This readObject method is used during the
deserialization process, when constructing a java object from a serialized
byte stream. It is possible to implement the method in such a way that can
result in java code being executed during the deserialization of an object
of this class (gadget class).

The JMS specification outlines a getObject() method on the
javax.jms.ObjectMessage
class. The Apache Artemis implementation of this method allows
deserialization of objects, from untrusted input. There are several places
where Apache Artemis uses this getObject() method. In the JMS Core client,
the Artemis broker and the Artemis REST component. These Artemis components
may therefore be vulnerable to a remote code execution attack. Successful
exploitations of this vulnerability rely on these "gadget classes"  being
present on the Artemis classpath and the sender of the untrusted input
being authenticated and authorized to send messages to the Artemis broker.
Comment 5 Hooman Broujerdi 2017-04-20 20:33:25 EDT 
Once the fix is in place for this issue, developers need to specify the whitelist and blacklist of classes that are allowed to be serialized as a query string on their broker url. For example the configuration could be "vm://hostname:port?deserializationBlackList=some.other.package&deserializationWhiteList=from.this.package". Please note the default whitelist and blacklist is configured via SystemProperty which sets to null by default and allows ever packages to be serialized. 

HorneQ users are advised to update to activemq artemis as these two products share the same codebase and eventually HornetQ will be retired.
Comment 7 errata-xmlrpc 2017-07-31 10:48:57 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:1836 https://access.redhat.com/errata/RHSA-2017:1836
Comment 8 errata-xmlrpc 2017-07-31 11:00:32 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:1835 https://access.redhat.com/errata/RHSA-2017:1835
Comment 9 errata-xmlrpc 2017-07-31 11:01:22 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1834 https://access.redhat.com/errata/RHSA-2017:1834
Comment 10 errata-xmlrpc 2017-07-31 11:20:39 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1837 https://access.redhat.com/errata/RHSA-2017:1837
Comment 11 Ravindra Patil 2017-09-12 13:03:09 EDT 
This does affect JBoss Enterprise Application Platform 6

Any ETA for release of the fix for EAP 6 ?
Comment 12 Wei Chen 2017-09-29 02:20:40 EDT 
I want to know if this affects Jboss EAP 6? If yes, whih version should we take for update?
Comment 13 Ravindra Patil 2017-11-10 04:16:47 EST 
Fix have been released for Jboss EAP 7.
CVE does affect EAP 6 as well

Will there be any fix released for Jboss EAP 6 for this CVE ?

Any update would be helpful. Thanks
Comment 15 errata-xmlrpc 2017-12-13 12:33:32 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456
Comment 16 errata-xmlrpc 2017-12-13 13:20:00 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454
Comment 17 errata-xmlrpc 2017-12-13 13:41:25 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7

Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455
Comment 18 errata-xmlrpc 2017-12-13 13:46:57 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458
Comment 19 errata-xmlrpc 2018-05-14 16:15:38 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2018:1447 https://access.redhat.com/errata/RHSA-2018:1447
Comment 20 errata-xmlrpc 2018-05-14 16:35:40 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2018:1448 https://access.redhat.com/errata/RHSA-2018:1448
Comment 21 errata-xmlrpc 2018-05-14 16:38:30 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2018:1449 https://access.redhat.com/errata/RHSA-2018:1449
Comment 22 errata-xmlrpc 2018-05-14 16:42:16 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2018:1450 https://access.redhat.com/errata/RHSA-2018:1450
Comment 23 errata-xmlrpc 2018-05-14 16:50:26 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2018:1451 https://access.redhat.com/errata/RHSA-2018:1451
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.