Description
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Spring AMQP | 1.x – < 1.7.10, 2.x – < 2.0.6 | 1.7.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.rabbitmq:amqp-client | < 4.8.0 | 4.8.0 | GHSA-w4g2-9hj6-5472 |
| Maven | com.rabbitmq:amqp-client | >= 5.0.0, < 5.4.0 | 5.4.0 | GHSA-w4g2-9hj6-5472 |
| Maven | org.springframework.amqp:spring-amqp | >= 2.0.0, < 2.0.6 | 2.0.6 | GHSA-w4g2-9hj6-5472 |
| Maven | org.springframework.amqp:spring-amqp | < 1.7.10 | 1.7.10 | GHSA-w4g2-9hj6-5472 |