Lucene search

[email protected]CVE-2021-22095

HistoryNov 30, 2021 - 7:15 p.m.

CVE-2021-22095

2021-11-3019:15:08

CWE-502

[email protected]

web.nvd.nist.gov

cve-2021-22095

spring

amqp

oom error

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

34.8%

JSON

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

Affected configurations

NVD

Node

vmwarespring_advanced_message_queuing_protocolRange2.2.0–2.2.19

vmwarespring_advanced_message_queuing_protocolRange2.3.0–2.3.11

CPENameOperatorVersion
vmware:spring_advanced_message_queuing_protocolvmware spring advanced message queuing protocollt2.2.19
vmware:spring_advanced_message_queuing_protocolvmware spring advanced message queuing protocollt2.3.11

CPE	Name	Operator	Version
vmware:spring_advanced_message_queuing_protocol	vmware spring advanced message queuing protocol	lt	2.2.19
vmware:spring_advanced_message_queuing_protocol	vmware spring advanced message queuing protocol	lt	2.3.11

CNA Affected

[
  {
    "product": "Spring AMQP",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Spring AMQP versions 2.2.X prior to 2.2.20 and 2.3.x prior to 2.3.12 ."
      }
    ]
  }
]