{"id":"CVE-2017-8045","description":"In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.","cvssScore":9.8,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssMetrics":[{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-502"],"resolved":"MITIGATED-BY-RASP","published":"2017-11-27","lastModified":"2026-06-17","affectedProducts":[{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.0"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.0","update":"m1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.0","update":"rc1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.2"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.3"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.4"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.5"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.5.6"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.0"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.0","update":"m1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.0","update":"m2"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.0","update":"rc1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.1"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.2"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.3"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.4"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.5"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.6"},{"vendor":"pivotal software","product":"spring advanced message queuing protocol","version":"1.6.7"}],"totalAffectedProducts":1,"references":[{"url":"https://pivotal.io/security/cve-2017-8045","source":"osv","tags":["WEB"]},{"url":"http://www.securityfocus.com/bid/100936","source":"osv","tags":["WEB"]}],"reasoning":{"decidingSource":"secure-rule-match","decidingReason":"Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-502: Deserialization of Untrusted Data) can be mitigated by an ARMR deserialization security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.springframework.amqp:spring-amqp"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.springframework.amqp:spring-amqp). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written."},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"CWE-502 (Deserialization of Untrusted Data) is mitigable by an ARMR deserialization security rule.","decisive":true},{"rule":"below-action-threshold","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit-published","stage":"disposition","outcome":"skipped"}],"affectedProducts":[{"vendor":"pivotal_software","product":"spring_advanced_message_queuing_protocol","isKnown":false,"cpe":"cpe:2.3:a:pivotal_software:spring_advanced_message_queuing_protocol:1.5.0:*:*:*:*:*:*:*"}],"affectedPackages":[{"name":"org.springframework.amqp:spring-amqp","introduced":"0","fixed":"1.5.7"},{"name":"org.springframework.amqp:spring-amqp","introduced":"1.6.0","fixed":"1.6.11"},{"name":"org.springframework.amqp:spring-amqp","introduced":"1.7.0","fixed":"1.7.4"}]},"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["security-rule"],"ruleClass":"deserialization"},"action":{"state":"available","type":"security-rule"},"review":{"state":"automated","basis":"inferred"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.03554,"percentile":0.88678},"ssvc":{"available":false}}