Man-In-The-Middle (MitM)

org.springframework.amqp, spring-rabbit is vulnerable to a man-in-the-middle MitM. The vulnerability is due to the Log4j2 appender relying on an insecure documented default TLS configuration, which allows an attacker capable of intercepting the TLS connection to perform a man-in-the-middle attack...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the AmqpAppender. An attacker can intercept or modify sensitive log data by performing a man-in-the-middle attack on the TLS connection, as hostname verification is disabled by default. Remediation...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. An attacker can obtain sensitive credentials by accessing exception messages that are logged,...