High severity7.2NVD Advisory· Published Sep 27, 2016· Updated Jun 17, 2026
CVE-2016-4978
CVE-2016-4978
Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.activemq:artemis-pomMaven | < 1.4.0 | 1.4.0 |
Affected products
1Patches
Vulnerability mechanics
References
27- mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3EnvdMailing ListVendor AdvisoryWEB
- www.securityfocus.com/bid/93142nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2017:1834nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1835nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1836nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1837nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3454nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3455nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3456nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3458nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1447nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1448nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1449nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1450nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1451nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-r9vv-xj4w-g8m8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-4978ghsaADVISORY
- www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdfnvdTechnical DescriptionThird Party AdvisoryWEB
- lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2%40%3Cissues.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2@%3Cissues.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02%40%3Cissues.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02@%3Cissues.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3EghsaWEB
- web.archive.org/web/20210123172653/http://www.securityfocus.com/bid/93142ghsaWEB
News mentions
0No linked articles in our index yet.