Deserialization of Untrusted Data in Spring AMQP
Moderate severity
GitHub Reviewed
Published
Dec 1, 2021
to the GitHub Advisory Database
•
Updated May 15, 2024
Package
Affected versions
>= 2.3.0, <= 2.3.10
>= 2.2.0, <= 2.2.19
Patched versions
2.3.11
2.2.20
Description
Published by the National Vulnerability Database
Nov 30, 2021
Published to the GitHub Advisory Database
Dec 1, 2021
Reviewed
Jun 22, 2022
Last updated
May 15, 2024
Credits
-
SunBK201 Analyst
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
References