CVE-2021-22095
Medium
Description
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
SeverityMedium
CVSS6.5
Exploit probability—
Product
Vmware Spring Advanced Message Queuing Protocol
PublishedNov 30, 2021
First seenNov 30, 2021
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- vmware spring_advanced_message_queuing_protocol2.2.19, 2.3.11 or later
- org.springframework.amqp:spring-amqp2.2.20, 2.3.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_advanced_message_queuing_protocol | 2.2.0 ≤ v < 2.2.19, 2.3.0 ≤ v < 2.3.11 | 2.2.19, 2.3.11 |
| org.springframework.amqp:spring-amqpMaven | 2.2.0 ≤ v < 2.2.20, 2.3.0 ≤ v < 2.3.11 | 2.2.20, 2.3.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.