Deserialization of Untrusted Data in Spring AMQP
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
>= 2.2.0, <= 2.2.18
>= 2.3.0, <= 2.3.10
Patched versions
2.2.19
2.3.11
Description
Published by the National Vulnerability Database
Oct 28, 2021
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jun 22, 2022
Last updated
Jan 27, 2023
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
References