CVE-2016-2173

Description

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

How to fix CVE-2016-2173

To remediate CVE-2016-2173, upgrade the affected package to a fixed version below.

• Maven/org.springframework.amqp:spring-amqp—upgrade to 1.5.5 or later

Is CVE-2016-2173 being exploited?

Moderate — EPSS is 21.3%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, < 1.5.5

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-2173
• WEBlists.fedoraproject.org/pipermail/package-announce/2016-April/182551.html
• WEBlists.fedoraproject.org/pipermail/package-announce/2016-April/182850.html
• WEBlists.fedoraproject.org/pipermail/package-announce/2016-April/182959.html