PT-2017-18088 · Pivotal · Spring Amqp

Man Yue Mo · Published 2017-11-27 · Updated 2022-05-17 · CVE-2017-8045

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Spring AMQP versions prior to 1.7.4 Pivotal Spring AMQP versions prior to 1.6.11 Pivotal Spring AMQP versions prior to 1.5.7

Description The issue allows an org.springframework.amqp.core.Message to be unsafely deserialized when being converted into a string, potentially enabling a remote code execution attack if a malicious payload is crafted.

Recommendations For versions prior to 1.7.4, update to version 1.7.4 or later. For versions prior to 1.6.11, update to version 1.6.11 or later. For versions prior to 1.5.7, update to version 1.5.7 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-8045

GHSA-VQQG-XGV7-CF68

Affected Products

Spring Amqp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-8045 · Security Note
• https://pivotal.io/security/cve-2017-8045 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8045 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqqg-xgv7-cf68 · Vendor Advisory
• http://securityfocus.com/bid/100936 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8045 · Note