Red Hat Amq Broker 7
Monthly
Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clients to achieve remote code execution by sending crafted ObjectMessage payloads. The flaw stems from a logical inversion in the allow-list guard: when no allow-list is configured (the default), `isTrustedType()` unconditionally returns true, rendering the entire class-filtering mechanism inoperative. Affected products include Red Hat AMQ Broker 7, JBoss EAP 7 and 8, and Red Hat builds of Apache Camel - all widely deployed in enterprise Java environments. No public exploit or KEV listing has been identified at time of analysis, but deserialization gadget chains targeting common Java libraries are extensively documented.
Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clients to achieve remote code execution by sending crafted ObjectMessage payloads. The flaw stems from a logical inversion in the allow-list guard: when no allow-list is configured (the default), `isTrustedType()` unconditionally returns true, rendering the entire class-filtering mechanism inoperative. Affected products include Red Hat AMQ Broker 7, JBoss EAP 7 and 8, and Red Hat builds of Apache Camel - all widely deployed in enterprise Java environments. No public exploit or KEV listing has been identified at time of analysis, but deserialization gadget chains targeting common Java libraries are extensively documented.