CVE-2023-34050: Spring AMQP Deserialization Vulnerability
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
the SimpleMessageConverter or SerializerMessageConverter is used
the user does not configure allowed list patterns
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/spring-amqpto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
redhat/spring-amqpto a version that resolves this vulnerability.Fixed in 3.0.12 - Upgrade
Upgrade
redhat/spring-amqpto a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
redhat/spring-amqpto a version that resolves this vulnerability.Fixed in 3.2.0 - Upgrade
Upgrade
Spring AMQPto a version that resolves this vulnerability.Fixed in 3.0.9 - Configuration
In Spring AMQP, configure allowed list patterns for deserializable class types when using SimpleMessageConverter or SerializerMessageConverter so that messages from untrusted sources cannot deserialize arbitrary classes (the vulnerability occurs when no allowed list patterns are provided and all classes can be deserialized).
Spring AMQP (SimpleMessageConverter / SerializerMessageConverter) allowed list patterns for deserializable class = provide an allowed list (do not leave it unset) - Compensating control
Ensure that only trusted/untrusted-appropriate message sources can send messages to the RabbitMQ broker (the issue is exploitable when malicious content is received from untrusted message originators).
Event History
Frequently Asked Questions
What is CVE-2023-34050?
CVE-2023-34050 is a vulnerability in Spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 that allows deserialization of data from untrusted sources.
How does CVE-2023-34050 affect VMware Spring Advanced Message Queuing Protocol?
CVE-2023-34050 affects VMware Spring Advanced Message Queuing Protocol versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9.
What is the severity of CVE-2023-34050?
The severity of CVE-2023-34050 is medium with a CVSS score of 5.
How can I fix CVE-2023-34050?
To fix CVE-2023-34050, upgrade to a patched version of Spring AMQP (2.4.17 or 3.0.10 or higher) or apply the recommended security patches.
Where can I find more information about CVE-2023-34050?
More information about CVE-2023-34050 can be found at the following reference: [CVE-2023-34050](https://spring.io/security/cve-2023-34050).