CVE-2021-22095

CWE-502 — Deserialization of Untrusted Data5 documents4 sources
Severity
6.5MEDIUM
EPSS
0.6%
top 31.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vmware Spring Advanced Message Queuing Protocol
Timeline
PublishedNov 30
Latest updateDec 1

Description

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.springframework.amqp:spring-amqp2.2.0 — 2.2.20+1
▶CVEListV5spring_amqpSpring AMQP versions 2.2.X prior to 2.2.20 and 2.3.x prior to 2.3.12 .

🔴Vulnerability Details

4
OSV
Deserialization of Untrusted Data in Spring AMQP↗2021-12-01
▶
GHSA
Deserialization of Untrusted Data in Spring AMQP↗2021-12-01
▶
OSV
CVE-2021-22095: In Spring AMQP versions 2↗2021-11-30
▶
CVEList
CVE-2021-22095: In Spring AMQP versions 2↗2021-11-30
▶
CVE-2021-22095 (MEDIUM CVSS 6.5) | In Spring AMQP versions 2.2.0 - 2.2 | cvebase.io