GitHub Advisoryadvisory · Maven

GHSA-v525-c3g5-cg9p Unsafe Deserialization that can Result in Code Execution

HIGH Published 2021-12-10 Modified 2021-03-15 Official page ↗
Aliases
CVE-2020-36282
Ecosystem
Maven
Packages
com.rabbitmq.jms:rabbitmq-jms
Severity
High
Weaknesses
CWE-502
Reviewed
2021-03-15

Affected packages

• Maven com.rabbitmq.jms:rabbitmq-jms: >= 2.0, < 2.2.0 → fixed in 2.2.0 • Maven com.rabbitmq.jms:rabbitmq-jms: >= 1.0, < 1.15.2 → fixed in 1.15.2

Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

Related

Alias · CVE (1)

  • CVE-2020-36282 JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References