GitHub Advisoryadvisory · Maven

GHSA-vqqg-xgv7-cf68 Deserialization of Untrusted Data in Spring AMQP

CRITICAL Published 2022-05-17 Modified 2022-06-30 Official page ↗
Aliases
CVE-2017-8045
Ecosystem
Maven
Packages
org.springframework.amqp:spring-amqp
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-06-30

Affected packages

• Maven org.springframework.amqp:spring-amqp: < 1.5.7 → fixed in 1.5.7 • Maven org.springframework.amqp:spring-amqp: >= 1.6.0, < 1.6.11 → fixed in 1.6.11 • Maven org.springframework.amqp:spring-amqp: >= 1.7.0, < 1.7.4 → fixed in 1.7.4

Description

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

Related

Alias · CVE (1)

  • CVE-2017-8045 In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References