Spring AMQP Remote Code Execution Vulnerability Fixed by 1.6 M2 and 1.5.5
Description
(:A vulnerability was reported in Spring AMQP.:A remote attacker could exploit it via a specially crafted serialized object (like Chris Frohoff's Commons Collection) in order to execute arbitrary code.::This vulnerability stems from an lack of validation by the "org.springframework.core.serializer.DefaultDeserializer" class for the deserialized object against a whitelist.)
Vulnerable Products
Vulnerable OS: Fedora (Red Hat) - 22, 23
Solution
Fixed springframework-amqp packages for Fedora 22 are available.
