GHSA-v525-c3g5-cg9p
Unsafe Deserialization that can Result in Code Execution
At a glance
- Published
- Updated
- CVE
- CVE-2020-36282
Description
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Affected packages
| Package | Versions |
|---|---|
| Maven · com.rabbitmq.jms:rabbitmq-jms | introduced 2.0, fixed 2.2.0 |
| Maven · com.rabbitmq.jms:rabbitmq-jms | introduced 1.0, fixed 1.15.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-36282 ADVISORY
- https://github.com/rabbitmq/rabbitmq-jms-client/issues/135 WEB
- https://github.com/rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638 WEB
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2 WEB
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0 WEB
- https://medium.com/@ramon93i7/a99645d0448b WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |