{"id":"CVE-2018-11087","details":"Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.","aliases":["GHSA-w4g2-9hj6-5472"],"modified":"2026-07-08T14:59:55.571704Z","published":"2018-09-14T20:29:00.417Z","references":[{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2018-11087"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"3ec04dfdca61160201dca3abeb8d08f5afef2aa4"},{"introduced":"2a756285428f8ee02bf5de2791c187c683725f0f"},{"fixed":"7f527b51a12f7905215a6be008ba9baca660ede2"}],"database_specific":{"cpe":"cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.8.0"},{"introduced":"4.8.1"},{"fixed":"5.4.0"}],"source":"CPE_RANGE"}}],"versions":["v5.4.0.RC3","v4.8.0.RC3","v5.4.0.RC2","v4.8.0.RC2","v5.4.0.RC1","v4.8.0.RC1","v5.4.0.M1","v4.8.0.M1","v4.7.0","v4.7.0.RC1","v4.6.0","v4.6.0.RC1","v5.2.0","v5.2.0.RC1","v4.5.0","v4.5.0.RC3","v4.5.0.RC2","v4.5.0.RC1","v5.1.0","v4.4.0","v5.1.0.RC1","v4.4.0.RC2","v4.4.0.RC1","v4.3.0","v4.3.0.RC2","v4.3.0.RC1","v5.0.0","v5.0.0.RC1","v4.2.0","v4.2.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11087.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-amqp","events":[{"introduced":"8ae9f4fd5a1a90ad912a2aa1dce147f993202655"},{"fixed":"471a91d0535742cbcfe9b51faf1c0bb273b88679"},{"introduced":"026848555dfa1ff41b808b868905ba5109726229"},{"fixed":"942201172257576f2423e8b51371c5214201857d"}],"database_specific":{"cpe":"cpe:2.3:a:pivotal_software:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.7.10"},{"introduced":"2.0.0"},{"fixed":"2.0.6"}],"source":"CPE_RANGE"}}],"versions":["v2.0.5.RELEASE","v2.0.4.RELEASE","v2.0.3.RELEASE","v2.0.2.RELEASE","v2.0.1.RELEASE","v2.0.0.RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11087.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}