CVE-2020-36282: Unsafe Deserialization in JMS Client for RabbitMQ
Summary
CVE-2020-36282: Unsafe Deserialization that can Result in Code Execution. Affects com.rabbitmq.jms:rabbitmq-jms across 2 version ranges.
>= 1.0, < 1.15.2
>= 2.0, < 2.2.0
Fixed in 1.15.2 or 2.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JMS Client for RabbitMQ is a library that provides Java Message Service (JMS) support for RabbitMQ, a popular open-source message broker. It allows Java applications to send and receive messages using the JMS API. The library is commonly used in enterprise applications for reliable messaging and communication between distributed components.
Vulnerability Detail
The JMS Client for RabbitMQ versions 1.x before 1.15.2 and 2.x before 2.2.0 are vulnerable to an unsafe deserialization issue. This vulnerability can be exploited by an attacker who can provide crafted StreamMessage data. When this malicious data is deserialized, it can lead to arbitrary code execution, potentially compromising the affected system. The vulnerability has been assigned the CVE identifier CVE-2020-36282.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0, < 1.15.21.15.2 -
>= 2.0, < 2.2.02.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The JMS Client for RabbitMQ is vulnerable to an unsafe deserialization issue that can result in arbitrary code execution. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the library. For versions 1.x, upgrade to version 1.15.2 or later. For versions 2.x, upgrade to version 2.2.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.rabbitmq.jms:rabbitmq-jms →
FAQ
JMS Client for RabbitMQ is a library that provides Java Message Service (JMS) support for RabbitMQ, allowing Java applications to send and receive messages using the JMS API.
Unsafe deserialization refers to the process of deserializing untrusted data, which can lead to the execution of arbitrary code. In this vulnerability, the JMS Client for RabbitMQ is vulnerable to unsafe deserialization when processing crafted StreamMessage data.
This vulnerability can allow an attacker to execute arbitrary code on the affected system. Depending on the privileges of the exploited process, this can lead to further compromise of the system, unauthorized access, or data exfiltration.
No, only versions 1.x before 1.15.2 and 2.x before 2.2.0 are affected. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed versions as soon as possible.
