[<prev] [next>] [day] [month] [year] [list]
Message-ID: <84a07a1a-a9aa-84d3-01a1-67641ee2ea85@apache.org>
Date: Fri, 18 Apr 2025 15:22:43 +0000
From: Arnout Engelen <engelen@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-29953: Apache ActiveMQ NMS OpenWire Client:
deserialization allowlist bypass
Severity: moderate
Affected versions:
- Apache ActiveMQ NMS OpenWire Client before 2.1.1
Description:
Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.
This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed.
The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether.
Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
This issue is being tracked as AMQNET-844
Credit:
g7shot working with Trend Zero Day Initiative (finder)
References:
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-29953
https://issues.apache.org/jira/browse/AMQNET-844
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
