CVE-2016-2173: Input Validation
A remote code execution vulnerability was found in Spring AMQP. The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved.
External references:
https://jira.spring.io/browse/AMQP-590 http://pivotal.io/security/cve-2016-2173
Upstream fix:
https://github.com/spring-projects/spring-amqp/commit/4150f107e60cac4a7735fcf7cb4c1889a0cbab6c
Other sources
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2173?
CVE-2016-2173 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-2173?
To mitigate CVE-2016-2173, upgrade Spring AMQP to version 1.5.5 or later.
Which software is affected by CVE-2016-2173?
CVE-2016-2173 affects Fedora versions 22, 23, and 24, as well as Spring AMQP versions prior to 1.5.5.
What type of vulnerability is CVE-2016-2173?
CVE-2016-2173 is a remote code execution vulnerability stemming from improper deserialization checks.
What do I need to understand about CVE-2016-2173's exploit?
Exploiting CVE-2016-2173 requires supplying a crafted serialized object that bypasses the deserialization validation.