GHSA-vqqg-xgv7-cf68CriticalCVSS 9.8

Deserialization of Untrusted Data in Spring AMQP

Published
May 17, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-8045 →

📋 Description

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

🎯 Affected products3

  • maven/org.springframework.amqp:spring-amqp:< 1.5.7
  • maven/org.springframework.amqp:spring-amqp:>= 1.6.0, < 1.6.11
  • maven/org.springframework.amqp:spring-amqp:>= 1.7.0, < 1.7.4

🔗 References (4)