Описание
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
A flaw was found in Spring AMQP. The system generates predictable correlation identifiers (IDs) for message replies due to an internal simple counter. This predictability could allow an attacker to potentially infer or manipulate message flows, leading to a low impact on the confidentiality and integrity of data.
Отчет
Red Hat products that bundle Spring AMQP are affected by this flaw. However, exploitation requires the application to use fixed reply queues rather than exclusive/auto-delete queues, and the attacker needs high privileges and network access to the RabbitMQ broker, significantly limiting practical exploitability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-amqp | Fix deferred | ||
| Red Hat Fuse 7 | spring-amqp | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | spring-amqp | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
EPSS
4.4 Medium
CVSS3