Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

Remediation

References

https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0

https://github.com/rabbitmq/rabbitmq-jms-client/issues/135

https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2

https://medium.com/%40ramon93i7/a99645d0448b

Related Vulnerabilities

CVE-2021-41580 Vulnerability in npm package passport-oauth2

CVE-2020-24025 Vulnerability in maven package org.webjars.npm:node-sass

CVE-2015-1835 Vulnerability in npm package cordova-android

CVE-2020-8131 Vulnerability in npm package yarn

CVE-2020-15366 Vulnerability in npm package ajv

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Release Notes Third Party Advisory Patch