Maven/org.apache.rocketmq:rocketmq-namesrv CVE-2023-33246: critical 9.8, exploited, EPSS 96.57%
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
Action: Upgrade org.apache.rocketmq:rocketmq-namesrv to 4.9.6 (4.x) or 5.1.1 (5.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.9.6 | - |
| 5.0.0 | 5.1.1 | - |
Fixed versions
| 4.9.6 | 5.1.1 |
Sources
- osv: GHSA-x3cq-8f32-5f63#Maven/org.apache.rocketmq:rocketmq-namesrv
- kev: CVE-2023-33246
- https://nvd.nist.gov/vuln/detail/CVE-2023-33246
- https://github.com/apache/rocketmq/commit/9d411cf04a695e7a3f41036e8377b0aa544d754d
- https://github.com/apache/rocketmq/commit/c3ada731405c5990c36bf58d50b3e61965300703
- https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT
- https://github.com/apache/rocketmq
- https://github.com/jakabakos/CVE-2023-33246_Apache_RocketMQ_RCE
- https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-33246
- https://www.vicarius.io/vsociety/posts/rocketmq-rce-cve-2023-33246-33247
- http://packetstormsecurity.com/files/173339/Apache-RocketMQ-5.1.0-Arbitrary-Code-Injection.html
- http://www.openwall.com/lists/oss-security/2023/07/12/1
CVE-2023-33246 · published · modified · JSON