Description
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 | Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.amqp:spring-amqp | < 1.5.7 | 1.5.7 | GHSA-vqqg-xgv7-cf68 |
| Maven | org.springframework.amqp:spring-amqp | >= 1.6.0, < 1.6.11 | 1.6.11 | GHSA-vqqg-xgv7-cf68 |
| Maven | org.springframework.amqp:spring-amqp | >= 1.7.0, < 1.7.4 | 1.7.4 | GHSA-vqqg-xgv7-cf68 |