Описание
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
A flaw was found in Spring AMQP. Applications that configure their broker connection using RabbitConnectionFactoryBean.setUri("amqps://...") without explicitly enabling SSL via setUseSSL(true) may establish a TLS (Transport Layer Security) encrypted connection without proper certificate validation or hostname verification. This oversight could allow a remote attacker to intercept and potentially read sensitive information by performing a Man-in-the-Middle attack.
Отчет
Red Hat products that bundle Spring AMQP are affected by this flaw. However, exploitation requires the application to use the specific pattern of calling RabbitConnectionFactoryBean.setUri() with an amqps:// URI without also calling setUseSSL(true), and the attacker must be in a Man-in-the-Middle position on the network path to the RabbitMQ broker.
Меры по смягчению последствий
When using RabbitConnectionFactoryBean.setUri() with an amqps:// URI, explicitly call setUseSSL(true) to enable proper certificate validation and hostname verification.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-amqp | Fix deferred | ||
| Red Hat Fuse 7 | spring-amqp | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | spring-amqp | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
5.9 Medium
CVSS3