Deserialization of Untrusted Data in Spring AMQP

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-22097 · ADVISORY
• tanzu.vmware.com/security/cve-2021-22097 · WEB

org.springframework.amqp:spring-amqp のその他の脆弱性

• CVE-2026-41714中 4.0Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(tru…
• CVE-2026-41701中 4.4Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter…
• CVE-2021-22095中 6.5In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new Strin…
• CVE-2018-11087中 5.9Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of h…
• CVE-2017-8045緊急 9.8In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized whe…