Description

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

Remediation

References

https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0

https://github.com/rabbitmq/rabbitmq-jms-client/issues/135

https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2

https://medium.com/%40ramon93i7/a99645d0448b

Related Vulnerabilities

CVE-2020-12642 Vulnerability in maven package com.epam.reportportal:service-api

CVE-2023-25722 Vulnerability in maven package com.veracode.jenkins:veracode-scan

CVE-2018-14041 Vulnerability in maven package org.webjars:bootstrap

CVE-2019-10803 Vulnerability in npm package push-dir

CVE-2020-11059 Vulnerability in npm package aegir

Severity

Critical

Classification

CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Release Notes Third Party Advisory Patch