CVE-2016-2173

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code...

CVE-2016-2173

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code...

CVE-2016-2173

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code...

Pivotal Software Spring AMQP Remote Code Execution Vulnerability

Pivotal Software Spring AMQP is the U.S. Pivotal Software Spring Framework based on a set of AMQP messaging solution . The solution provides templated send and receive messages and message-driven abstraction layer based on message-driven POJO classes and so on. A remote code execution vulnerabili...

[SECURITY] Fedora 22 Update: springframework-amqp-1.3.9-4.fc22

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

[SECURITY] Fedora 23 Update: springframework-amqp-1.3.9-4.fc23

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

[SECURITY] Fedora 24 Update: springframework-amqp-1.3.9-4.fc24

The Spring AMQP project applies core Spring concepts to the development of AMQP-based messaging solutions. It provides a "template" as a high-level abstraction for sending and receiving messages. It also provides support for Message driven POJOs with a "listener container". These libraries...

Remote Code Execution in Spring AMQP

The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved...