{"id":"GHSA-v525-c3g5-cg9p","summary":"Unsafe Deserialization that can Result in Code Execution","details":"JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.","aliases":["CVE-2020-36282"],"modified":"2024-12-02T05:35:24.873014Z","published":"2021-12-10T17:15:49Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-03-15T23:45:19Z","nvd_published_at":"2021-03-12T01:15:00Z","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36282"},{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-jms-client/issues/135"},{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638"},{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2"},{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0"},{"type":"WEB","url":"https://medium.com/@ramon93i7/a99645d0448b"}],"affected":[{"package":{"name":"com.rabbitmq.jms:rabbitmq-jms","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq.jms/rabbitmq-jms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.2.0"}]}],"versions":["2.0.0","2.1.0","2.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-v525-c3g5-cg9p/GHSA-v525-c3g5-cg9p.json"}},{"package":{"name":"com.rabbitmq.jms:rabbitmq-jms","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq.jms/rabbitmq-jms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.15.2"}]}],"versions":["1.10.0","1.11.0","1.11.1","1.11.2","1.12.0","1.13.0","1.14.0","1.15.0","1.15.1","1.4.7","1.5.0","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-v525-c3g5-cg9p/GHSA-v525-c3g5-cg9p.json"}}],"schema_version":"1.9.0"}