Description
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.rabbitmq.jms:rabbitmq-jms | >= 2.0, < 2.2.0 | 2.2.0 | GHSA-v525-c3g5-cg9p |
| Maven | com.rabbitmq.jms:rabbitmq-jms | >= 1.0, < 1.15.2 | 1.15.2 | GHSA-v525-c3g5-cg9p |