CVE-2021-20318 Deserialization in Artemis in EAP 7
Remote attackers can execute arbitrary code via unsafe deserialization of JMS ObjectMessages in Red Hat JBoss EAP Artemis.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20318?
CVE-2021-20318 is a high-severity unsafe deserialization vulnerability in Redhat Jboss Enterprise Application Platform, published on 23 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
Weakness: CWE-502
Which versions are affected by CVE-2021-20318?
It affects 1 product.
Products include Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2021-20318?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-20318 being exploited?
There is no known exploitation of CVE-2021-20318 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-36vx-8x4w-9h2m.