Skip to content
Fencer Intel
critical 9.8

CVE-2015-5254 in the critical feed json

Improper Input Validation in Apache ActiveMQ

published 2016-01-08 10 y ago modified 2026-06-17 4 mo ago also GHSA-q9hr-3pg4-3jp4 , EUVD-2022-4933

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
38.2%
EPSS 38.2% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Patch / fix

  • maven org.apache.activemq:activemq-client 5.11.3, 5.12.2
  • activemq Debian 13, Debian 12 5.13.2+dfsg-1

debian advisories DEBIAN-CVE-2015-5254

  • activemq Ubuntu 14.04 LTS 5.6.0+dfsg-1+deb7u2build0.14.04.1

ubuntu advisories UBUNTU-CVE-2015-5254

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php openshift 2.0 5.3.3-46.el6_7.1
  • rhc openshift 2.0 1.38.6.1-1.el6op
  • jenkins openshift 2.0 1.625.3-1.el6op
  • php-fpm openshift 2.0 5.3.3-46.el6_7.1
  • activemq openshift 2.0 5.9.0-6.redhat.611454.el6op
  • php-imap openshift 2.0 5.3.3-46.el6_7.1
  • php-intl openshift 2.0 5.3.3-46.el6_7.1
  • php-bcmath openshift 2.0 5.3.3-46.el6_7.1

red hat advisories RHSA-2016:0489

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-5254 updated cvss 6.0

ObjectMessage: unsafe deserialization

  • Red Hat JBoss A-MQ 6 activemq activemq
    affected: workaround, no fix available
  • Red Hat JBoss Enterprise Application Platform 6 hornetq hornetq Red Hat JBoss Enterprise Application Platform 7 artemis artemis
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 activemq activemq Red Hat JBoss Fuse Service Works 6 activemq activemq
    affected: workaround, no fix available
  • Red Hat JBoss A-MQ 6.3
    fixed: vendor fix RHSA-2016:2036
  • Red Hat JBoss Fuse 6.3
    fixed: vendor fix RHSA-2016:2035
  • Red Hat OpenShift Enterprise Client 2.2 rhc 1.38.6.1-1.el6op Red Hat OpenShift Enterprise Infrastructure 2.2 activemq 5.9.0-6.redhat.611454.el6op, openshift-enterprise-release 2.2.9-1.el6op, openshift-enterprise-upgrade 2.2.9-1.el6op, activemq-client 5.9.0-6.redhat.611454.el6op, openshift-origin-broker-util 1.37.5.3-1.el6op, openshift-enterprise-yum-validator 2.2.9-1.el6op, +4 more Red Hat OpenShift Enterprise Node 2.2 php 5.3.3-46.el6_7.1, jenkins 1.625.3-1.el6op, php-fpm 5.3.3-46.el6_7.1, php-imap 5.3.3-46.el6_7.1, php-intl 5.3.3-46.el6_7.1, php-bcmath 5.3.3-46.el6_7.1, +19 more
    fixed: vendor fix RHSA-2016:0489

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

38.19% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.activemq:activemq-client
>=5.0.0, <5.11.3
>=5.12.0, <5.12.2
5.11.3
5.12.2

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.