springframework-amqp: code execution
| Package(s): | springframework-amqp | CVE #(s): | CVE-2016-2173 | ||||||||
| Created: | April 21, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the CVE entry: The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved. | ||||||||||
| Alerts: |
| ||||||||||