UBUNTU-CVE-2021-22095
Dashboard / Vulnerabilities / UBUNTU-CVE-2021-22095
Summary:
Details: In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
References: https://ubuntu.com/security/CVE-2021-22095, https://tanzu.vmware.com/security/cve-2021-22097, https://www.cve.org/CVERecord?id=CVE-2021-22095
Affected packages
Package
Name: spring
Purl: pkg:deb/ubuntu/spring?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
100.0+dfsg-2
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
