Pivotal Software Spring Advanced Message Queuing Protocol vulnerabilities

2 CVEs affecting Pivotal Software Spring Advanced Message Queuing Protocol, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11087, published 2018-09-14.

More from Pivotal Software.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8045, published 2017-11-27. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could…
• CVE-2018-11087, published 2018-09-14. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability…