CVE-2017-8045 Deserialization of Untrusted Data in Spring AMQP
CriticalCVSS 9.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.amqp/spring-amqp(Maven) | < 1.5.7 | 1.5.7 |
| org.springframework.amqp/spring-amqp(Maven) | >= 1.6.0, < 1.6.11 | 1.6.11 |
| org.springframework.amqp/spring-amqp(Maven) | >= 1.7.0, < 1.7.4 | 1.7.4 |
| org.springframework.amqp/spring-amqp(Maven) | = 1.0.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.1.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.2.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.7.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.8.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.3.9.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.2.RELEASE | No fix listed |
Show 53 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.4.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.5.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.10.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.3.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.4.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.5.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.6.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.7.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.8.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.6.9.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.7.0.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.7.1.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.7.2.RELEASE | No fix listed |
| org.springframework.amqp/spring-amqp(Maven) | = 1.7.3.RELEASE | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.0 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.0-m1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.0-rc1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.2 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.3 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.4 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.5 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.5.6 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.0 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.0-m1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.0-m2 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.0-rc1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.2 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.3 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.4 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.5 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.6 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.7 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.8 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.9 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.6.10 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.7.0 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.7.1 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.7.2 | No fix listed |
| pivotal software spring advanced message queuing protocol | = 1.7.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- pivotal.io vendor-advisory
- 100936 third-party-advisory vdb-entry
- github.com