GitHub Advisoryadvisory · Maven

GHSA-fj8f-56wc-q36r rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message

CRITICAL Published 2023-07-17 Modified 2023-07-28 Official page ↗
Aliases
CVE-2023-26512
Ecosystem
Maven
Packages
org.apache.eventmesh:eventmesh-connector-rabbitmq
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-28

Affected packages

• Maven org.apache.eventmesh:eventmesh-connector-rabbitmq: >= 1.7.0, <= 1.8.0 (no fix yet)

Description

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, the new version is set to be released as soon as possible.

Related

Alias · CVE (1)

  • CVE-2023-26512 CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References