PT-2021-14850 · Spring · Spring Amqp
R00T4Dm
·
Published
2021-10-26
·
Updated
2022-05-24
·
CVE-2021-22097
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Spring AMQP versions 2.2.0 through 2.2.18
Spring AMQP versions 2.3.0 through 2.3.10
Description
The issue arises from the Spring AMQP Message object's toString() method, which deserializes a body for a message with content type application/x-java-serialized-object. This allows for the construction of a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called. Additionally, the method can create a new String object from the message body, regardless of its size, potentially leading to an OOM Error with large messages.
Recommendations
For Spring AMQP versions 2.2.0 through 2.2.18, consider disabling the toString() method for the Spring AMQP Message object until a patch is available.
For Spring AMQP versions 2.3.0 through 2.3.10, restrict the use of the toString() method for the Spring AMQP Message object to prevent potential CPU usage issues and OOM Errors.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spring Amqp