{"action":"Upgrade org.apache.flume.flume-ng-sources:flume-jms-source to 1.11.0 or later.","affected":[{"fixed":"1.11.0","introduced":"0"}],"component":"org.apache.flume.flume-ng-sources:flume-jms-source","cve_ids":["CVE-2022-42468"],"ecosystem":"Maven","epss":0.03722,"exploited":false,"fixed_versions":["1.11.0"],"ghsa_id":"GHSA-9w4g-fp9h-3q2v","id":"tcs_01M5N8QXM7KS69K1RD5Y88P1N1","modified_at":"2024-02-16T08:16:33.439990Z","published_at":"2022-10-26T19:00:38Z","references":["https://osv.dev/vulnerability/GHSA-9w4g-fp9h-3q2v","https://nvd.nist.gov/vuln/detail/CVE-2022-42468","https://github.com/apache/flume/commit/eee179a09df405c1ab55ae25a53b76ca1050bb97","https://github.com/apache/flume","https://issues.apache.org/jira/browse/FLUME-3437","https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz","https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9w4g-fp9h-3q2v","url":"https://osv.dev/vulnerability/GHSA-9w4g-fp9h-3q2v"}],"summary":"Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL"}