CVE-2016-2173 Improper Input Validation in Spring AMQP
CriticalCVSS 9.8
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.amqp/spring-amqp(Maven) | <= 1.5.4 | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | < 1.5.5 | 1.5.5 |
| org.springframework.amqp/spring-amqp(Maven) | = 1.0.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.7.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.8.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.9.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.3.RELEASE | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.4.RELEASE | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| fedoraproject fedora | = 24 | No fix listed |
| VMware spring advanced message queuing protocol | < 1.5.5 | 1.5.5 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch
- pivotal.io third-party-advisory
- FEDORA-2016-005ac9cfd5 patch third-party-advisory vendor-advisory
- FEDORA-2016-f099190fee patch third-party-advisory vendor-advisory
- FEDORA-2016-6cf17ad0df patch third-party-advisory vendor-advisory
- github.com