CVE-2016-8648 Deserialization in Karaf

What is CVE-2016-8648?

CVE-2016-8648 is a high-severity unsafe deserialization vulnerability in Apache Software Foundation Karaf, published on 1 Aug 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.

Weakness: CWE-502

Which versions are affected by CVE-2016-8648?

It affects 2 products.

Products include Redhat Jboss A-Mq, Redhat Jboss Fuse.

How do I fix CVE-2016-8648?

No fix has been published for CVE-2016-8648 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2016-8648 being exploited?

There is no known exploitation of CVE-2016-8648 in the wild and no public exploit code.

Other vulnerabilities in Apache Software Foundation Karaf

• CVE-2020-14379 XML external entity in Red Hat AMQ Medium 5.6
• CVE-2023-4066 Operator: passwords defined in secrets shown in statefulset yaml Medium 5.5
• CVE-2023-4065 Operator: plaintext password in operator log Medium 5.5
• CVE-2015-5181 Cross-site scripting in n/a Medium 5.4
• CVE-2016-8653 Deserialization in Fuse Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rcmq-ww8v-3mxm.