{
"id": "GHSA-v525-c3g5-cg9p",
"aliases": [
"CVE-2020-36282"
],
"details": "JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.",
"summary": "Unsafe Deserialization that can Result in Code Execution",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0"
},
{
"fixed": "2.2.0"
}
]
}
],
"package": {
"name": "com.rabbitmq.jms:rabbitmq-jms",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.15.2"
}
]
}
],
"package": {
"name": "com.rabbitmq.jms:rabbitmq-jms",
"ecosystem": "Maven"
}
}
],
"modified": "2021-03-15T23:45:19Z",
"severity": [],
"published": "2021-12-10T17:15:49Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36282",
"type": "ADVISORY"
},
{
"url": "https://github.com/rabbitmq/rabbitmq-jms-client/issues/135",
"type": "WEB"
},
{
"url": "https://github.com/rabbitmq/rabbitmq-jms-client/pull/136/commits/f647e5dbfe055a2ca8cbb16dd70f9d50d888b638",
"type": "WEB"
},
{
"url": "https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2",
"type": "WEB"
},
{
"url": "https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0",
"type": "WEB"
},
{
"url": "https://medium.com/@ramon93i7/a99645d0448b",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-03-12T01:15:00Z",
"github_reviewed_at": "2021-03-15T23:45:19Z"
}
}