Security Bulletin: Vulnerabilities in amqp-client affect IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management (CVE-2018-11087)

Summary IBM Storage Protect Backup-Archive Client Linux x8664 only, IBM Storage Protect for Virtual Environments Data Protection for VMware on Windows and Linux x8664, and IBM Storage Protect for Space Management Linux x8664 only can be affected by a vulnerability in Pivotal Sprint-AMQP and...

cn.kduck:kduck-core (=1.1.0), cn.kduck:kduck-security (=1.1.0) +131 more potentially affected by CVE-2021-22097 via org.springframework.amqp:spring-amqp (>=2.3.0 <=2.3.10)

org.springframework.amqp:spring-amqp MAVEN version =2.3.0, =1.3.20, =1.0.0, =1.7, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.2.1 - com.lwohvye:eladmin-system =2.6.14 and more Source cves: CVE-2021-22097 Source advisory: OSV:GHSA-FX7F-RJQJ-52PJ...

br.com.itsme:commons (>=0.0.4-ALPHA <=0.0.5-ALPHA), cn.amossun:starter-event (>=1.2.0-RELEASE <=1.2.1-RELEASE) +216 more potentially affected by CVE-2021-22097 via org.springframework.amqp:spring-amqp (>=2.2.0.RELEASE <=2.2.18.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =2.2.0.RELEASE, =0.0.4-ALPHA, =1.2.0-RELEASE, =0.2.0, =0.2.0, =0.2.0, =0.0.9, =1.1, =0.1.0, =0.1.0, =0.2.0 - com.farao-community.farao:gridcapa-dichotomy-runner-app =0.1.0 - com.farao-community.farao:gridcapa-dichotomy-runner-spring-boot-starter...

GHSA-FX7F-RJQJ-52PJ Deserialization of Untrusted Data in Spring AMQP

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100%...

Deserialization of Untrusted Data in Spring AMQP

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100%...

com.ahome-it:ahome-tooling-server-core (>=1.1.1-RELEASE <=1.1.3-RELEASE), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.1-RELEASE <=1.1.3-RELEASE) +8 more potentially affected by CVE-2017-8045 via org.springframework.amqp:spring-amqp (>=1.6.0.RELEASE <=1.6.10.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =1.6.0.RELEASE, =1.1.1-RELEASE, =1.1.1-RELEASE, =1.1.1-RELEASE, =1.1.1-RELEASE, =1.1.1-RELEASE, =5.2.0-RC1, =1.6.0.RELEASE, =1.6.0.RELEASE, =4.3.0.RELEASE, =4.3.11.RELEASE Source cves: CVE-2017-8045 Source advisory: OSV:GHSA-VQQG-XGV7-CF68...

Deserialization of Untrusted Data in Spring AMQP

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack...

cc.voox:publisher (=0.1.2.GA), com.ahome-it:ahome-tooling-server-core (=1.1.0-RELEASE) +215 more potentially affected by CVE-2017-8045 via org.springframework.amqp:spring-amqp (>=1.0.0.RELEASE <=1.5.6.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =1.0.0.RELEASE, =1.0, =1.0, =0.9.0, =0.20.0, =1.31.1, =1.27.1, =1.31.0, =1.31.1, =1.31.1, =1.34.1 and more Source cves: CVE-2017-8045 Source advisory: OSV:GHSA-VQQG-XGV7-CF68...

br.jus.stf.digital:core (>=0.2.0 <=2.3.1), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=A.1.1.0 <=A.2.0.0.RC1) +112 more potentially affected by CVE-2017-8045 via org.springframework.amqp:spring-amqp (>=1.7.0.RELEASE <=1.7.3.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =1.7.0.RELEASE, =0.2.0, =A.1.1.0, =A.1.1.0, =1.1.0, =1.1.0, =v1.0.0, =0.8, =0.8, =0.9 - com.societegenerale:rabbitmq-advanced-core =1.0.1.RELEASE - com.societegenerale:rabbitmq-advanced-parent =1.0.1.RELEASE -...

cc.voox:publisher (=0.1.2.GA), com.bluejeans:ipc-channel-utils (>=1.0 <=1.0.1) +141 more potentially affected by CVE-2016-2173 via org.springframework.amqp:spring-amqp (>=1.0.0.RELEASE <=1.5.4.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =1.0.0.RELEASE, =1.0, =1.0, =0.9.0, =0.20.0, =1.31.1, =1.27.1, =1.31.0, =1.31.1, =1.31.1, =1.31.1, =1.31.1, =1.31.1, =1.31.1, =1.34.1 - com.bq.oss.corbel:evci =1.20.0 and more Source cves: CVE-2016-2173 Source advisory: OSV:GHSA-HRP3-8P5W-27GV...

GHSA-HRP3-8P5W-27GV Improper Input Validation in Spring AMQP

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code...

Improper Input Validation in Spring AMQP

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code...

The vulnerability of the toString() method implementation in the Spring AMQP RabbitMQ messaging application allows a attacker to cause a service failure.

The vulnerability of the toString method implementation in the Spring AMQP RabbitMQ messaging application is related to the restoration of unreliable data in memory during the processing of Dictionary objects from the java.util class. Exploiting this vulnerability could allow an attacker to cause...

cn.kduck:kduck-core (=1.1.0), cn.kduck:kduck-security (=1.1.0) +131 more potentially affected by CVE-2021-22095 +1 more via org.springframework.amqp:spring-amqp (>=2.3.0 <=2.3.10)

org.springframework.amqp:spring-amqp MAVEN version =2.3.0, =1.3.20, =1.0.0, =1.7, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.2.1 - com.lwohvye:eladmin-system =2.6.14 and more Source cves: CVE-2021-22095, CVE-2021-22097 Source advisory: OSV:GHSA-945Q-CH46-PCHG...

GHSA-945Q-CH46-PCHG Deserialization of Untrusted Data in Spring AMQP

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

br.com.itsme:commons (>=0.0.4-ALPHA <=0.0.5-ALPHA), cn.amossun:starter-event (>=1.2.0-RELEASE <=1.2.1-RELEASE) +234 more potentially affected by CVE-2021-22095 +1 more via org.springframework.amqp:spring-amqp (>=2.2.0.RELEASE <=2.2.1.RELEASE)

org.springframework.amqp:spring-amqp MAVEN version =2.2.0.RELEASE, =0.0.4-ALPHA, =1.2.0-RELEASE, =1.0, =0.2.0, =0.2.0, =0.2.0, =2.0.0-RC1, =1.0.0-RC1, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =0.0.1-RELEASE, =0.0.1.RELEASE, =3.0.1.RELEASE and more Source cves: CVE-2021-22095, CVE-2021-2209...

CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

Code injection

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...