Описание
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.
A flaw was found in Spring Boot. When configured to use an SSL (Secure Sockets Layer) bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. This vulnerability could allow an attacker on the same network to intercept or alter communications. The primary consequences include potential information disclosure and data tampering.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | spring-boot | Fix deferred | ||
| Red Hat AMQ Clients | spring-boot | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | spring-boot | Fix deferred | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-boot | Fix deferred | ||
| Red Hat build of OptaPlanner 8 | spring-boot | Fix deferred | ||
| Red Hat Data Grid 8 | spring-boot | Fix deferred | ||
| Red Hat Enterprise Linux 8 | log4j:2/log4j | Fix deferred | ||
| Red Hat Enterprise Linux 9 | log4j | Out of support scope | ||
| Red Hat Fuse 7 | spring-boot | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | spring-boot | Fix deferred |
Показывать по
Дополнительная информация
Статус:
4.2 Medium
CVSS3
Связанные уязвимости
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.
Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker
4.2 Medium
CVSS3