https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Bug ID: 1291292 Summary: CVE-2015-5254 activemq: unsafe deserialization Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: abhgupta@redhat.com, agrimm@redhat.com, aileenc@redhat.com, ccoleman@redhat.com, chazlett@redhat.com, dmcphers@redhat.com, gvarsami@redhat.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, kconner@redhat.com, kseifried@redhat.com, ldimaggi@redhat.com, lmeyer@redhat.com, mmccomas@redhat.com, nwallace@redhat.com, pavelp@redhat.com, puntogil@libero.it, rwagner@redhat.com, soa-p-jira@post-office.corp.redhat.com, s@shk.io, tcunning@redhat.com, tdawson@redhat.com, tiwillia@redhat.com, tkirby@redhat.com
JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls.
This issue was fixed upstream in Apache ActiveMQ 5.13.0. Additionally, when using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at:
http://activemq.apache.org/objectmessage.html
External References:
http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announceme...
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1291293 Depends On| |1291294
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1291293 [Bug 1291293] CVE-2015-5254 activemq: unsafe deserialization [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #2 from Martin Prpic mprpic@redhat.com ---
Created activemq tracking bugs for this issue:
Affects: fedora-all [bug 1291293]
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1291295
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.8/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:N/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=affected,fsw-6.0.0/active |q=notaffected,fsw-6.0.0/act |mq=affected,fuse-6/activemq |ivemq=affected,fuse-6/activ |=affected,openshift-enterpr |emq=affected,openshift-ente |ise-2/activemq=affected,ope |rprise-2/activemq=affected, |nshift-1/activemq=affected |openshift-1/activemq=affect | |ed
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.8/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:N/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=notaffected,fsw-6.0.0/act |q=notaffected,fsw-6.0.0/act |ivemq=affected,fuse-6/activ |ivemq=affected,fuse-6/activ |emq=affected,openshift-ente |emq=notaffected,openshift-e |rprise-2/activemq=affected, |nterprise-2/activemq=affect |openshift-1/activemq=affect |ed,openshift-1/activemq=aff |ed |ected
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #3 from Kurt Seifried kseifried@redhat.com --- Upstream has more information on this issue available at:
https://issues.apache.org/jira/browse/AMQ-6013
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1293392
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #5 from gil cattaneo puntogil@libero.it --- (In reply to Kurt Seifried from comment #3)
Upstream has more information on this issue available at:
Hi Thanks but is too late, https://bugzilla.redhat.com/show_bug.cgi?id=1291293#c3
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- activemq-5.6.0-14.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292 Bug 1291292 depends on bug 1291293, which changed state.
Bug 1291293 Summary: CVE-2015-5254 activemq: unsafe deserialization [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291293
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- activemq-5.6.0-14.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Doc Text *updated* by Kurt Seifried kseifried@redhat.com --- It was found that ActiveMQ fails to safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the ActiveMQ application.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- It was found that ActiveMQ did not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the ActiveMQ application.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Enterprise 2.2
Via RHSA-2016:0489 https://rhn.redhat.com/errata/RHSA-2016-0489.html
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.8/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:N/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=notaffected,fsw-6.0.0/act |q=notaffected,fsw-6.0.x/act |ivemq=affected,fuse-6/activ |ivemq=affected,fuse-6/activ |emq=notaffected,openshift-e |emq=notaffected,openshift-e |nterprise-2/activemq=affect |nterprise-2/activemq=affect |ed,openshift-1/activemq=aff |ed,openshift-1/activemq=aff |ected |ected
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1320285
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1320039 CC| |amaris@redhat.com
--- Comment #10 from Jason Shepherd jshepherd@redhat.com --- *** Bug 1320038 has been marked as a duplicate of this bug. ***
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.8/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:N/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=notaffected,fsw-6.0.x/act |q=notaffected,fsw-6.0.x/act |ivemq=affected,fuse-6/activ |ivemq=affected,fuse-6/activ |emq=notaffected,openshift-e |emq=notaffected,openshift-e |nterprise-2/activemq=affect |nterprise-2/activemq=affect |ed,openshift-1/activemq=aff |ed,openshift-1/activemq=aff |ected |ected,eap-6/hornetq=affecte | |d
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jshepherd@redhat.com Summary|CVE-2015-5254 activemq: |CVE-2015-5254 JMS |unsafe deserialization |ObjectMessage: unsafe | |deserialization
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.8/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:N/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=notaffected,fsw-6.0.x/act |q=notaffected,fsw-6.0.x/act |ivemq=affected,fuse-6/activ |ivemq=affected,fuse-6/activ |emq=notaffected,openshift-e |emq=notaffected,openshift-e |nterprise-2/activemq=affect |nterprise-2/activemq=affect |ed,openshift-1/activemq=aff |ed,openshift-1/activemq=aff |ected,eap-6/hornetq=affecte |ected,eap-6/hornetq=affecte |d |d/cvss2=6.0/AV:N/AC:M/Au:S/ | |C:P/I:P/A:P
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Doc Text *updated* by Jason Shepherd jshepherd@redhat.com --- It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1326962 Depends On| |1326963
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|high |medium Severity|high |medium
--- Comment #12 from Jason Shepherd jshepherd@redhat.com --- You need to have deployed a JMS publisher, or subscriber which accepts JMS Object Message to be vulnerable to this flaw. Also, in order to connect to a HornetQ JMS server in EAP, a username, and password needs to be provided.
However if you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could work around this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach:
https://access.redhat.com/solutions/2190911
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=moderate,public=2015 |51208,reported=20151208,sou |1208,reported=20151208,sour |rce=oss-security,cvss2=6.0/ |ce=oss-security,cvss2=6.0/A |AV:N/AC:M/Au:S/C:P/I:P/A:P, |V:N/AC:M/Au:S/C:P/I:P/A:P,c |cwe=CWE-502,fedora-all/acti |we=CWE-502,fedora-all/activ |vemq=affected,amq-6/activem |emq=affected,amq-6/activemq |q=notaffected,fsw-6.0.x/act |=notaffected,fsw-6.0.x/acti |ivemq=affected,fuse-6/activ |vemq=affected,fuse-6/active |emq=notaffected,openshift-e |mq=notaffected,openshift-en |nterprise-2/activemq=affect |terprise-2/activemq=affecte |ed,openshift-1/activemq=aff |d,openshift-1/activemq=affe |ected,eap-6/hornetq=affecte |cted,eap-6/hornetq=affected |d |
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Severity|high |medium
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |51208,reported=20151208,sou |51208,reported=20151208,sou |rce=oss-security,cvss2=6.8/ |rce=oss-security,cvss2=6.0/ |AV:N/AC:M/Au:N/C:P/I:P/A:P, |AV:N/AC:M/Au:S/C:P/I:P/A:P, |cwe=CWE-502,fedora-all/acti |cwe=CWE-502,fedora-all/acti |vemq=affected,amq-6/activem |vemq=affected,amq-6/activem |q=notaffected,fsw-6.0.x/act |q=notaffected,fsw-6.0.x/act |ivemq=affected,fuse-6/activ |ivemq=affected,fuse-6/activ |emq=notaffected,openshift-e |emq=notaffected,openshift-e |nterprise-2/activemq=affect |nterprise-2/activemq=affect |ed,openshift-1/activemq=aff |ed,openshift-1/activemq=aff |ected,eap-6/hornetq=affecte |ected,eap-6/hornetq=affecte |d/cvss2=6.0/AV:N/AC:M/Au:S/ |d |C:P/I:P/A:P |
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|high |medium
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=notaffected,fsw-6.0.x/acti |=notaffected,fsw-6.0.x/acti |vemq=affected,fuse-6/active |vemq=affected,fuse-6/active |mq=notaffected,openshift-en |mq=notaffected,openshift-en |terprise-2/activemq=affecte |terprise-2/activemq=affecte |d,openshift-1/activemq=affe |d,openshift-1/activemq=affe |cted,eap-6/hornetq=affected |cted,eap-6/hornetq=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=notaffected,fsw-6.0.x/acti |=wontfix,fsw-6.0.x/activemq |vemq=affected,fuse-6/active |=affected,fuse-6/activemq=n |mq=notaffected,openshift-en |otaffected,openshift-enterp |terprise-2/activemq=affecte |rise-2/activemq=affected,op |d,openshift-1/activemq=affe |enshift-1/activemq=affected |cted,eap-6/hornetq=wontfix |,eap-6/hornetq=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=wontfix,fsw-6.0.x/activemq |=wontfix,fsw-6.0.x/activemq |=affected,fuse-6/activemq=n |=affected,fuse-6/activemq=w |otaffected,openshift-enterp |ontfix,openshift-enterprise |rise-2/activemq=affected,op |-2/activemq=affected,opensh |enshift-1/activemq=affected |ift-1/activemq=affected,eap |,eap-6/hornetq=wontfix |-6/hornetq=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=wontfix,fsw-6.0.x/activemq |=affected,fsw-6.0.x/activem |=affected,fuse-6/activemq=w |q=affected,fuse-6/activemq= |ontfix,openshift-enterprise |affected,openshift-enterpri |-2/activemq=affected,opensh |se-2/activemq=affected,open |ift-1/activemq=affected,eap |shift-1/activemq=affected,e |-6/hornetq=wontfix |ap-6/hornetq=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Clebert Suconic csuconic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |csuconic@redhat.com
--- Comment #16 from Clebert Suconic csuconic@redhat.com --- I don't think this is really an issue for Artemis or HornetQ
ObjectMessage is only a tool for the clients to generate and parse their User objects.. they belong to the client, not to the server.
In Artemis everything is a byte Array. The thin JMS layer exists to bring an utility to the client to generate and parse objects. they belong to the client.
We could maybe protect clients by adding restricted packages on the classLoading. But we can't be over restrictive here as that would break a lot of users using ObjectMessage.
Although MDBs run inside the server's VM at Wildfly. But I'm still not convinced this is an issue, since the producer would need access to the queue at producer's clearance.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #17 from Jason Shepherd jshepherd@redhat.com --- Statement:
A malicious message producer needs to authenticate to EAP in order to send messages. Therefore this issue is rated as moderate.
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #18 from Jason Shepherd jshepherd@redhat.com --- Mitigation:
If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach:
https://access.redhat.com/solutions/2190911
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1385169
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dedgar@redhat.com Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=affected,fsw-6.0.x/activem |=affected,fsw-6.0.x/activem |q=affected,fuse-6/activemq= |q=affected,fuse-6/activemq= |affected,openshift-enterpri |affected,openshift-enterpri |se-2/activemq=affected,open |se-2/activemq=wontfix,opens |shift-1/activemq=affected,e |hift-1/activemq=defer,eap-6 |ap-6/hornetq=wontfix |/hornetq=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |bkundal@redhat.com, | |dimitris@redhat.com, | |dosoudil@redhat.com, | |psotirop@redhat.com Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015 |1208,reported=20151208,sour |1208,reported=20151208,sour |ce=oss-security,cvss2=6.0/A |ce=oss-security,cvss2=6.0/A |V:N/AC:M/Au:S/C:P/I:P/A:P,c |V:N/AC:M/Au:S/C:P/I:P/A:P,c |we=CWE-502,fedora-all/activ |we=CWE-502,fedora-all/activ |emq=affected,amq-6/activemq |emq=affected,amq-6/activemq |=affected,fsw-6.0.x/activem |=affected,fsw-6.0.x/activem |q=affected,fuse-6/activemq= |q=affected,fuse-6/activemq= |affected,openshift-enterpri |affected,openshift-enterpri |se-2/activemq=wontfix,opens |se-2/activemq=wontfix,opens |hift-1/activemq=defer,eap-6 |hift-1/activemq=defer,eap-6 |/hornetq=wontfix |/hornetq=wontfix,eap-7/arte | |mis=wontfix
--- Comment #20 from Jason Shepherd jshepherd@redhat.com --- Mitigation:
If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue using the features of the Java Virtual Machine added in JEP 290:
http://openjdk.java.net/jeps/290
https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #22 from Andrej Nemec anemec@redhat.com --- Mitigation:
If you do deploy a JMS publisher, and subscriber, and don't trust the messages sent to you by your clients, you could mitigate this issue by installing a Java agent which restricts the classes which can be deserialized. This is an article with the recommended approach:
https://access.redhat.com/solutions/2190911
You could also mitigate this issue using the features of the Java Virtual Machine added in JEP 290:
http://openjdk.java.net/jeps/290
java-sig-commits@lists.fedoraproject.org