| Package | Affected versions | Patched versions |
|---|---|---|
| com.rabbitmq:amqp-client | ≥ 5.0.0, < 5.4.0< 4.8.0 | 5.4.04.8.0 |
| org.springframework.amqp:spring-amqp | ≥ 2.0.0, < 2.0.6< 1.7.10 | 2.0.61.7.10 |
| spring advanced message queuing protocol | ≥ 1.0.0, < 1.7.10≥ 2.0.0, < 2.0.6 | 1.7.102.0.6 |
| rabbitmq java client | ≥ 4.8.1, < 5.4.0< 4.8.0 | 5.4.04.8.0 |
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free