{
  "cveId": "CVE-2023-46604",
  "url": "https://patchblox.com/security/cve/CVE-2023-46604",
  "summary": "CVE-2023-46604 is fixed in 2 products on 1 platform, first by activemq 5.16.1-1ubuntu0.1~esm1, released October 27, 2023. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on November 2, 2023, with known ransomware use. Patch Radar priority: Patch now.",
  "title": "activemq: The Java OpenWire protocol marshaller is vulnerable to Remote Code  Execution",
  "description": "The Java OpenWire protocol marshaller is vulnerable to Remote Code  Execution. This vulnerability may allow a remote attacker with network  access to either a Java-based OpenWire broker or client to run arbitrary  shell commands by manipulating serialized class types in the OpenWire  protocol to cause either the client or the broker (respectively) to  instantiate any class on the classpath.  Users are recommended to upgrade  both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3  which fixes this issue.",
  "published": "2023-10-27T08:15:00Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.99992,
  "epssPercentile": 0.99986,
  "priority": "Patch now",
  "priorityTier": 1,
  "exploited": true,
  "vendorExploited": false,
  "disclosed": false,
  "kev": {
    "added": "2023-11-02T00:00:00Z",
    "due": "2023-11-23T00:00:00Z",
    "ransomware": true,
    "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
  },
  "fixes": [
    {
      "platform": "linux",
      "product": "activemq",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.17.2\u002Bdfsg-2\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2023-46604",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-46604",
      "released": "2023-10-27T15:15:14Z"
    },
    {
      "platform": "linux",
      "product": "activemq",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.17.6\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-46604",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-46604",
      "released": "2023-10-27T15:15:14Z"
    },
    {
      "platform": "linux",
      "product": "activemq",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "5.15.8-2~18.04.1~esm1",
      "fix": "activemq 5.15.8-2~18.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-activemq-5.15.8-2-18.04.1-esm1",
      "released": "2023-11-28T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "activemq",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "5.15.11-1ubuntu0.1~esm1",
      "fix": "activemq 5.15.11-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-activemq-5.15.11-1ubuntu0.1-esm1",
      "released": "2023-11-28T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "activemq",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "5.16.1-1ubuntu0.1~esm1",
      "fix": "activemq 5.16.1-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-activemq-5.16.1-1ubuntu0.1-esm1",
      "released": "2023-10-27T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libactivemq-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "5.15.8-2~18.04.1~esm1",
      "fix": "libactivemq-java 5.15.8-2~18.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libactivemq-java-5.15.8-2-18.04.1-esm1",
      "released": "2023-11-28T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libactivemq-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "5.15.11-1ubuntu0.1~esm1",
      "fix": "libactivemq-java 5.15.11-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libactivemq-java-5.15.11-1ubuntu0.1-esm1",
      "released": "2023-11-28T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libactivemq-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "5.16.1-1ubuntu0.1~esm1",
      "fix": "libactivemq-java 5.16.1-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libactivemq-java-5.16.1-1ubuntu0.1-esm1",
      "released": "2023-10-27T08:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}