High severity7.2NVD Advisory· Published Sep 27, 2016· Updated May 6, 2026
CVE-2016-4978
CVE-2016-4978
Description
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.activemq:artemis-pomMaven | < 1.4.0 | 1.4.0 |
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
27- mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3EnvdMailing ListVendor AdvisoryWEB
- www.securityfocus.com/bid/93142nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2017:1834nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1835nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1836nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1837nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3454nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3455nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3456nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:3458nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1447nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1448nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1449nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1450nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:1451nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-r9vv-xj4w-g8m8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-4978ghsaADVISORY
- www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdfnvdTechnical DescriptionThird Party AdvisoryWEB
- lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2%40%3Cissues.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2@%3Cissues.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02%40%3Cissues.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02@%3Cissues.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3EnvdWEB
- lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3EghsaWEB
- web.archive.org/web/20210123172653/http://www.securityfocus.com/bid/93142ghsaWEB
News mentions
0No linked articles in our index yet.