Code injection

2021-10-2816:15:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.2%

JSON

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

CPENameOperatorVersion
spring_advanced_message_queuing_protocolge2.2.0
spring_advanced_message_queuing_protocolle2.2.18
spring_advanced_message_queuing_protocolge2.3.0
spring_advanced_message_queuing_protocolle2.3.10

Name	Operator	Version
spring_advanced_message_queuing_protocol	ge	2.2.0
spring_advanced_message_queuing_protocol	le	2.2.18
spring_advanced_message_queuing_protocol	ge	2.3.0
spring_advanced_message_queuing_protocol	le	2.3.10

References

tanzu.vmware.com/security/cve-2021-22097