Description

In affected versions of Spring AMQP, a org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

Affected Spring Products and Versions

Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7

Mitigation

Users of affected versions should apply the following mitigation:

Releases that have fixed this issue include:<ul><li>Spring AMQP: 2.0.0, 1.7.4, 1.6.11, 1.5.7</li></ul>

Credit

This vulnerability was responsibly reported by Man Yue Mo from Semmle and lgtm.com.

History

2017-09-19: Initial vulnerability report published

Reporting a vulnerability

The VMware Security Response team provides a single point of contact for the reporting of security vulnerabilities in VMware Tanzu products and coordinates the process of investigating any reported vulnerabilities.

To report a security vulnerability in a VMware service or product please refer to the VMware Security Response Policy.