{"action":"Upgrade org.apache.activemq:artemis-pom to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"org.apache.activemq:artemis-pom","cve_ids":["CVE-2016-4978"],"ecosystem":"Maven","epss":0.06879,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-r9vv-xj4w-g8m8","id":"tcs_01M5N9BDTZFWNRFBAF72QH3Y1A","modified_at":"2024-03-13T05:31:35.292422Z","published_at":"2022-05-13T01:11:53Z","references":["https://osv.dev/vulnerability/GHSA-r9vv-xj4w-g8m8","https://nvd.nist.gov/vuln/detail/CVE-2016-4978","https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities.pdf","https://web.archive.org/web/20210123172653/http://www.securityfocus.com/bid/93142","https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3E","https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E","https://lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/d4ffbc6a43a915324a394b2913ceb7d07bc352f2d08caa19df0aff02%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/7260bd0955c12aac5bd892039d3356ba3aa0ff4caaf2aa4fd4fe84a2%40%3Cissues.activemq.apache.org%3E","https://github.com/apache/activemq-artemis","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2017:3458","https://access.redhat.com/errata/RHSA-2017:3456","https://access.redhat.com/errata/RHSA-2017:3455","https://access.redhat.com/errata/RHSA-2017:3454","https://access.redhat.com/errata/RHSA-2017:1837","https://access.redhat.com/errata/RHSA-2017:1836","https://access.redhat.com/errata/RHSA-2017:1835","https://access.redhat.com/errata/RHSA-2017:1834","http://mail-archives.apache.org/mod_mbox/activemq-users/201609.mbox/%3CCAH6wpnqzeNtpykT7emtDU1-GV7AvjFP5-YroWcCC4UZyQEFvtA%40mail.gmail.com%3E"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-r9vv-xj4w-g8m8","url":"https://osv.dev/vulnerability/GHSA-r9vv-xj4w-g8m8"}],"summary":"Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain"}