PT-2025-17306 · Apache · Apache Activemq Nms Openwire Client

G7Shot · Published 2025-04-18 · Updated 2025-05-05 · CVE-2025-29953

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ NMS OpenWire Client versions prior to 2.1.1

Description The issue affects the Apache ActiveMQ NMS OpenWire Client when connecting to untrusted servers, allowing these servers to potentially abuse unbounded deserialization in the client. This could lead to malicious responses causing arbitrary code execution on the client. The .NET team has deprecated the built-in .NET binary serialization feature, and the project is considering dropping this part of the NMS API.

Recommendations Upgrade to version 2.1.1 to fix the issue. Migrate away from relying on .NET binary serialization as a hardening method for the future.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-05147

CVE-2025-29953

GHSA-9G64-R942-FVMP

ZDI-25-266

Affected Products

Apache Activemq Nms Openwire Client

References · 21

• https://bdu.fstec.ru/vul/2025-05147 · Security Note
• https://osv.dev/vulnerability/GHSA-9g64-r942-fvmp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29953 · Security Note
• https://lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-266 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29953 · Vendor Advisory
• https://github.com/apache/activemq-nms-openwire/commit/8944c41 · Note
• https://github.com/apache/activemq-nms-openwire · Note
• https://twitter.com/SystemTek_UK/status/1918210881449570486 · Twitter Post
• https://twitter.com/oss_security/status/1913257973507379305 · Twitter Post
• https://openwall.com/lists/oss-security/2025/04/18/3 · Note
• https://twitter.com/f1tym1/status/1917875342930284738 · Twitter Post
• https://t.me/cvedetector/23317 · Telegram Post
• https://issues.apache.org/jira/browse/AMQNET-844 · Note
• https://t.me/cvetracker/21928 · Telegram Post