CVE-2016-8653 Deserialization in Fuse

What is CVE-2016-8653?

CVE-2016-8653 is a medium-severity unsafe deserialization vulnerability in Red Hat Fuse, published on 1 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.

Weakness: CWE-502

Which versions are affected by CVE-2016-8653?

It affects 2 products.

Products include Redhat Jboss A-Mq, Redhat Jboss Fuse.

How do I fix CVE-2016-8653?

No fix has been published for CVE-2016-8653 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2016-8653 being exploited?

There is no known exploitation of CVE-2016-8653 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Fuse

• CVE-2016-8648 Deserialization in Karaf High 7.2
• CVE-2020-14379 XML external entity in Red Hat AMQ Medium 5.6
• CVE-2023-4066 Operator: passwords defined in secrets shown in statefulset yaml Medium 5.5
• CVE-2023-4065 Operator: plaintext password in operator log Medium 5.5
• CVE-2015-5181 Cross-site scripting in n/a Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9f74-frh8-4gmr.