GHSA-vqqg-xgv7-cf68

Source

https://github.com/advisories/GHSA-vqqg-xgv7-cf68

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vqqg-xgv7-cf68/GHSA-vqqg-xgv7-cf68.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vqqg-xgv7-cf68

Aliases

CVE-2017-8045

Published

2022-05-17T00:16:13Z

Modified

2023-11-08T03:59:27Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Deserialization of Untrusted Data in Spring AMQP

Details

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

Database specific

{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-30T21:12:41Z",
    "nvd_published_at":  "2017-11-27T10:29:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.7

Affected versions

1.*

1.0.0.RELEASE

1.1.0.RELEASE

1.1.1.RELEASE

1.1.2.RELEASE

1.1.3.RELEASE

1.1.4.RELEASE

1.2.0.RELEASE

1.2.1.RELEASE

1.2.2.RELEASE

1.3.0.RELEASE

1.3.1.RELEASE

1.3.2.RELEASE

1.3.3.RELEASE

1.3.4.RELEASE

1.3.5.RELEASE

1.3.6.RELEASE

1.3.7.RELEASE

1.3.8.RELEASE

1.3.9.RELEASE

1.4.0.RELEASE

1.4.1.RELEASE

1.4.2.RELEASE

1.4.3.RELEASE

1.4.4.RELEASE

1.4.5.RELEASE

1.4.6.RELEASE

1.5.0.RELEASE

1.5.1.RELEASE

1.5.2.RELEASE

1.5.3.RELEASE

1.5.4.RELEASE

1.5.5.RELEASE

1.5.6.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vqqg-xgv7-cf68/GHSA-vqqg-xgv7-cf68.json"

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.6.0

Fixed

1.6.11

Affected versions

1.*

1.6.0.RELEASE

1.6.1.RELEASE

1.6.2.RELEASE

1.6.3.RELEASE

1.6.4.RELEASE

1.6.5.RELEASE

1.6.6.RELEASE

1.6.7.RELEASE

1.6.8.RELEASE

1.6.9.RELEASE

1.6.10.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vqqg-xgv7-cf68/GHSA-vqqg-xgv7-cf68.json"

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.7.0

Fixed

1.7.4

Affected versions

1.*

1.7.0.RELEASE

1.7.1.RELEASE

1.7.2.RELEASE

1.7.3.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vqqg-xgv7-cf68/GHSA-vqqg-xgv7-cf68.json"