critical9.8
CVE-2020-36282
Unsafe Deserialization that can Result in Code Execution
Impact
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.rabbitmq.jms:rabbitmq-jms | >= 2.0, < 2.2.0 | 2.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rabbitmq | Jms Client | from 1.0.0 before 1.15.2 from 2.0.0 before 2.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
- https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
- https://medium.com/%40ramon93i7/a99645d0448b
- https://github.com/advisories/GHSA-v525-c3g5-cg9p
- https://nvd.nist.gov/vuln/detail/CVE-2020-36282
- https://github.com/rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638
- https://medium.com/@ramon93i7/a99645d0448b