| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.amqp:spring-amqp | ≥ 1.6.0, < 1.6.11≥ 1.7.0, < 1.7.4< 1.5.7 | 1.6.111.7.41.5.7 |
| spring advanced message queuing protocol | = 1.5.0= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.5.6= 1.6.0= 1.6.1= 1.6.10= 1.6.2= 1.6.3= 1.6.4= 1.6.5= 1.6.6= 1.6.7= 1.6.8= 1.6.9= 1.7.0= 1.7.1= 1.7.2= 1.7.3 |
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free