CVE-2021-22097
Last modified
CVE-2021-22097 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.. EPSS estimates a 1.04% chance of exploitation in the next 30 days.
Description
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Advanced Message Queuing Protocol | >= 2.2.0, <= 2.2.18 |
| Vmware | Spring Advanced Message Queuing Protocol | >= 2.3.0, <= 2.3.10 |
References
- https://tanzu.vmware.com/security/cve-2021-22097Vendor Advisory
- https://tanzu.vmware.com/security/cve-2021-22097Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-22097?
How severe is CVE-2021-22097?
How do I fix CVE-2021-22097?
Are you affected by CVE-2021-22097?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST