CVE-2015-5254
Fixed in a distro release EPSS 38%
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Products: redhat openshift, apache activemq, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.activemq:activemq-client | 5.11.3 |
| Maven | org.apache.activemq:activemq-client | 5.12.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | activemq | 5.13.2+dfsg-1 |
| Debian 13 | activemq | 5.13.2+dfsg-1 |
| Debian 7 | activemq | 5.6.0+dfsg-1+deb7u2 |
| Debian 8 | activemq | 5.6.0+dfsg1-4+deb8u2 |
| Red Hat openshift 2.0 | activemq | 0:5.9.0-6.redhat.611454.el6op |
| Red Hat openshift 2.0 | activemq-client | 0:5.9.0-6.redhat.611454.el6op |
| Red Hat openshift 2.0 | jenkins | 0:1.625.3-1.el6op |
| Red Hat openshift 2.0 | openshift-enterprise-release | 0:2.2.9-1.el6op |
| Red Hat openshift 2.0 | openshift-enterprise-upgrade | 0:2.2.9-1.el6op |
| Red Hat openshift 2.0 | openshift-enterprise-upgrade-broker | 0:2.2.9-1.el6op |
| Red Hat openshift 2.0 | openshift-enterprise-upgrade-node | 0:2.2.9-1.el6op |
| Red Hat openshift 2.0 | openshift-enterprise-yum-validator | 0:2.2.9-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-broker-util | 0:1.37.5.3-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-cron | 0:1.25.2.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-haproxy | 0:1.31.5.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-mysql | 0:1.31.2.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-php | 0:1.35.3.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-cartridge-python | 0:1.34.2.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-msg-node-mcollective | 0:1.30.2.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-proxy | 0:1.26.2.1-1.el6op |
| Red Hat openshift 2.0 | openshift-origin-node-util | 0:1.38.6.2-1.el6op |
| Red Hat openshift 2.0 | php | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-bcmath | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-debuginfo | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-devel | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-fpm | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-imap | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-intl | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-mbstring | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | php-process | 0:5.3.3-46.el6_7.1 |
| Red Hat openshift 2.0 | rhc | 0:1.38.6.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-common | 0:1.29.5.2-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-console | 0:1.35.5.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-controller | 0:1.38.5.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-frontend-apache-vhost | 0:0.13.2.1-1.el6op |
| Red Hat openshift 2.0 | rubygem-openshift-origin-node | 0:1.38.5.3-1.el6op |
| Ubuntu 14.04 LTS | activemq | 5.6.0+dfsg-1+deb7u2build0.14.04.1 |