Deserialization of Untrusted Data in Spring AMQP

2022-05-1700:16:13

Google

osv.dev

0.064 Low

EPSS

Percentile

93.7%

JSON

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

CPENameOperatorVersion
org.springframework.amqp:spring-amqpeq1.6.3.RELEASE
org.springframework.amqp:spring-amqpeq1.6.4.RELEASE
org.springframework.amqp:spring-amqpeq1.3.0.RELEASE
org.springframework.amqp:spring-amqpeq1.6.10.RELEASE
org.springframework.amqp:spring-amqpeq1.3.6.RELEASE
org.springframework.amqp:spring-amqpeq1.6.5.RELEASE
org.springframework.amqp:spring-amqpeq1.4.0.RELEASE
org.springframework.amqp:spring-amqpeq1.1.2.RELEASE
org.springframework.amqp:spring-amqpeq1.4.3.RELEASE
org.springframework.amqp:spring-amqpeq1.3.8.RELEASE

Name	Operator	Version
org.springframework.amqp:spring-amqp	eq	1.6.3.RELEASE
org.springframework.amqp:spring-amqp	eq	1.6.4.RELEASE
org.springframework.amqp:spring-amqp	eq	1.3.0.RELEASE
org.springframework.amqp:spring-amqp	eq	1.6.10.RELEASE
org.springframework.amqp:spring-amqp	eq	1.3.6.RELEASE
org.springframework.amqp:spring-amqp	eq	1.6.5.RELEASE
org.springframework.amqp:spring-amqp	eq	1.4.0.RELEASE
org.springframework.amqp:spring-amqp	eq	1.1.2.RELEASE
org.springframework.amqp:spring-amqp	eq	1.4.3.RELEASE
org.springframework.amqp:spring-amqp	eq	1.3.8.RELEASE