CVE-2021-22095: Medium severity VMware Spring Advanced Message Queuing Protocol vulnerability
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.amqp:spring-amqpto a version that resolves this vulnerability.Fixed in 2.2.20 - Upgrade
Upgrade
maven/org.springframework.amqp:spring-amqpto a version that resolves this vulnerability.Fixed in 2.3.11
Event History
Frequently Asked Questions
What is CVE-2021-22095?
CVE-2021-22095 is a vulnerability in Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11 that can cause an OOM Error with a large message.
How does CVE-2021-22095 affect Spring AMQP?
CVE-2021-22095 affects Spring AMQP by causing an Out-of-Memory (OOM) error when the toString() method creates a new String object from the message body, regardless of its size.
What is the severity of CVE-2021-22095?
The severity of CVE-2021-22095 is medium with a severity value of 6.5.
Which software versions are affected by CVE-2021-22095?
CVE-2021-22095 affects Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11.
How can I fix CVE-2021-22095?
To fix CVE-2021-22095, update Spring AMQP to a version higher than 2.3.11 or 2.2.19, depending on the affected version.