CVE-2021-22097: Medium severity spring amqp vulnerability
Published Oct 28, 2021
·Updated
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
Affected Software
2 affected components
VMware Spring Advanced Message Queuing Protocol>=2.2.0<=2.2.18
VMware Spring Advanced Message Queuing Protocol>=2.3.0<=2.3.10
Event History
Oct 28, 2021
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2021-22097.
2
What is the severity level of CVE-2021-22097?
The severity level of CVE-2021-22097 is medium (6.5).
3
Which versions of Spring AMQP are affected by CVE-2021-22097?
Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10 are affected by CVE-2021-22097.
4
What is the impact of CVE-2021-22097?
CVE-2021-22097 can allow a malicious java.util.Dictionary object to cause 100% CPU usage.
5
How can I mitigate CVE-2021-22097?
To mitigate CVE-2021-22097, update Spring AMQP to a version higher than 2.3.10 or 2.2.18.