CVE-2021-22097 — Deserialization of Untrusted Data in Vmware Spring Advanced Message Queuing Protocol

CWE-502 — Deserialization of Untrusted Data4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vmware Spring Advanced Message Queuing Protocol
Timeline
PublishedOct 28
Latest updateMay 24

Description

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
Deserialization of Untrusted Data in Spring AMQP↗2022-05-24
▶
OSV
Deserialization of Untrusted Data in Spring AMQP↗2022-05-24
▶
CVEList
CVE-2021-22097: In Spring AMQP versions 2↗2021-10-28
▶