CVE-2016-4974 Improper Input Validation in Apache Qpid AMQP 0-x JMS
Remote authenticated users can execute arbitrary code via crafted serialized objects in JMS messages due to unrestricted classpath deserialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-4974?
CVE-2016-4974 is a high-severity unsafe deserialization vulnerability in n/a, published on 13 Jul 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Weakness: CWE-20
Which versions are affected by CVE-2016-4974?
2 open source packages ship an affected version, including org.apache.qpid:qpid-jms-client. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.qpid:qpid-jms-client Maven | All versions | 0.10.0 |
org.apache.qpid:qpid-jms-client Maven | All versions | 0.10.0 |
Products include Apache Amqp 0-X Jms Client, Apache Jms Client Amqp.
How do I fix CVE-2016-4974?
Upgrade org.apache.qpid:qpid-jms-client to 0.10.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-4974 being exploited?
There is no known exploitation of CVE-2016-4974 in the wild and no public exploit code.
Sources
Also known as GHSA-f38p-mq64-h784, UBUNTU-CVE-2016-4974.