CVE-2021-22095: Deserialization of Untrusted Data in Spring AMQP
Summary
CVE-2021-22095: Deserialization of Untrusted Data in Spring AMQP. Affects org.springframework.amqp:spring-amqp across 2 version ranges.
>= 2.2.0, < 2.2.20
>= 2.3.0, < 2.3.11
Fixed in 2.2.20 or 2.3.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring AMQP is a popular open-source library that provides support for the Advanced Message Queuing Protocol (AMQP) in Spring applications. It allows developers to send and receive messages asynchronously between applications. The library is widely used in enterprise systems for building scalable and reliable messaging solutions. However, versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11 of Spring AMQP are vulnerable to a deserialization issue.
Vulnerability Detail
The vulnerability (CVE-2021-22095) in Spring AMQP arises from the toString() method of the Message object. When this method is called, it creates a new String object from the message body, regardless of its size. This can lead to an Out-of-Memory (OOM) error if a large message is processed. An attacker could exploit this vulnerability by sending a specially crafted message to a vulnerable application, causing it to crash or become unresponsive. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.202.2.20 -
>= 2.3.0, < 2.3.112.3.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
In conclusion, the vulnerability (CVE-2021-22095) in Spring AMQP can lead to an Out-of-Memory (OOM) error when processing large messages. Upgrading to the fixed version of Spring AMQP is the recommended solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.amqp:spring-amqp →
FAQ
Spring AMQP is an open-source library that provides support for the Advanced Message Queuing Protocol (AMQP) in Spring applications. It allows developers to send and receive messages asynchronously between applications.
This vulnerability can cause an Out-of-Memory (OOM) error in applications using vulnerable versions of Spring AMQP. An attacker could exploit this vulnerability to crash or disrupt the affected application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version of Spring AMQP is the only solution.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.amqp:spring-amqp.
