Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Appli

Summary

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Timeline

1. Nov 9, 2017, 12:00 AM UTCCVE published
2. Aug 6, 2024, 7:51 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• commons-collections:commons-collectionsMaven

  fixed in 3.2.2

• org.apache.commons:commons-collections4Maven

  fixed in 4.1

• org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collectionsMaven

  From 3.2.1

• net.sourceforge.collections:collections-genericMaven

  4.01

• org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-genericMaven

  From 4.01

References 27