CVE-2018-11087: TLS validation error
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-11087?
CVE-2018-11087 is a vulnerability in Pivotal Spring AMQP that exposes a man-in-the-middle vulnerability due to lack of hostname validation.
How does CVE-2018-11087 impact Pivotal Spring AMQP?
CVE-2018-11087 allows a malicious user who can intercept traffic to view data in transit.
Which versions of Pivotal Spring AMQP are affected by CVE-2018-11087?
Pivotal Spring AMQP 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6 are affected by CVE-2018-11087.
What is the severity of CVE-2018-11087?
CVE-2018-11087 has a severity score of 5.9, which is considered medium.
Is there a fix for CVE-2018-11087?
Yes, Pivotal Spring AMQP users should update to version 1.7.10 or 2.0.6 to mitigate the vulnerability.