Deserialization of untrusted data in ActiveMQ - CVE-2022-41678

Vulnerability identifier: #VU83534

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41678

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in Jolokia. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

ActiveMQ
Jazz for Service Management
IBM Tivoli Netcool Impact
IBM Sterling Secure Proxy
IBM Sterling Control Center
Ubuntu
openEuler
activemq (Ubuntu package)
libactivemq-java (Ubuntu package)
activemq
activemq-javadoc
AMQ Broker
Fuse

Install updates from vendor's website.

ActiveMQ - addressed in versions 5.16.6, 5.17.4
Jazz for Service Management - update to 1.1.3.25
IBM Tivoli Netcool Impact - update to 7.1.0.31
activemq (Ubuntu package) - addressed in versions Ubuntu Pro, 5.16.1-1ubuntu0.1
libactivemq-java (Ubuntu package) - addressed in versions Ubuntu Pro, 5.16.1-1ubuntu0.1
activemq - update to 5.16.7-1
activemq-javadoc - update to 5.16.7-1
IBM Sterling Secure Proxy - addressed in versions 6.0.3 iFix 11, 6.1.0 iFix 03
IBM Sterling Control Center - update to 6.2.1.0.13
AMQ Broker - update to 7.12.0
Fuse - update to 7.13.0

• https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
• https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl

• Remote code execution in Apache ActiveMQ
• IBM Tivoli Netcool Impact update for Apache ActiveMQ
• openEuler update for activemq
• Multiple vulnerabilities in IBM Secure Proxy
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in Fuse 7.13
• Ubuntu update for activemq
• Deserialization of untrusted data in IBM Control Center
• Ubuntu update for activemq
• Multiple vulnerabilities in IBM Jazz for Service Management