CVE-2021-22097
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
En Spring AMQP versiones 2.2.0 - 2.2.18 y 2.3.0 - 2.3.10, el objeto Spring AMQP Message, en su método toString(), deserializará un cuerpo para un mensaje con tipo de contenido application/x-java-serialized-object. Es posible construir un objeto java.util.Dictionary malicioso que puede causar un uso del 100% de la CPU en la aplicación si es llamado al método toString()
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-04 CVE Reserved
- 2021-10-28 CVE Published
- 2023-05-21 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tanzu.vmware.com/security/cve-2021-22097 | 2021-11-01 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Vmware Search vendor "Vmware" | Spring Advanced Message Queuing Protocol Search vendor "Vmware" for product "Spring Advanced Message Queuing Protocol" | >= 2.2.0 <= 2.2.18 Search vendor "Vmware" for product "Spring Advanced Message Queuing Protocol" and version " >= 2.2.0 <= 2.2.18" | - |
Affected
| ||||||
Vmware Search vendor "Vmware" | Spring Advanced Message Queuing Protocol Search vendor "Vmware" for product "Spring Advanced Message Queuing Protocol" | >= 2.3.0 <= 2.3.10 Search vendor "Vmware" for product "Spring Advanced Message Queuing Protocol" and version " >= 2.3.0 <= 2.3.10" | - |
Affected
|