https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Bug ID: 1291292 Summary: CVE-2015-5254 activemq: unsafe deserialization Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: abhgupta@redhat.com, agrimm@redhat.com, aileenc@redhat.com, ccoleman@redhat.com, chazlett@redhat.com, dmcphers@redhat.com, gvarsami@redhat.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kconner@redhat.com, kseifried@redhat.com, ldimaggi@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, nwallace@redhat.com, pavelp@redhat.com, puntogil@libero.it, rwagner@redhat.com, soa-p-jira@post-office.corp.redhat.com, s@shk.io, tcunning@redhat.com, tdawson@redhat.com, tiwillia@redhat.com, tkirby@redhat.com
JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls.
This issue was fixed upstream in Apache ActiveMQ 5.13.0. Additionally, when using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at:
http://activemq.apache.org/objectmessage.html
External References:
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announceme...