What is GHSA-v525-c3g5-cg9p?

GHSA-v525-c3g5-cg9p is a security advisory published by GitHub Security Advisories with High severity. Unsafe Deserialization that can Result in Code Execution

Which CVE IDs does GHSA-v525-c3g5-cg9p cover?

GHSA-v525-c3g5-cg9p covers the following CVE IDs: CVE-2020-36282. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-v525-c3g5-cg9p?

GHSA-v525-c3g5-cg9p affects 2 products, including: maven/com.rabbitmq.jms:rabbitmq-jms:\u003e= 2.0, \u003c 2.2.0; maven/com.rabbitmq.jms:rabbitmq-jms:\u003e= 1.0, \u003c 1.15.2.

GHSA-v525-c3g5-cg9pHigh

Unsafe Deserialization that can Result in Code Execution

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-36282 →

📋 Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

🎯 Affected products2

maven/com.rabbitmq.jms:rabbitmq-jms:>= 2.0, < 2.2.0
maven/com.rabbitmq.jms:rabbitmq-jms:>= 1.0, < 1.15.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2020-36282
https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
https://github.com/rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
https://medium.com/@ramon93i7/a99645d0448b
https://github.com/advisories/GHSA-v525-c3g5-cg9p