Vulnerabilidades do Vmware Spring Advanced Message Queuing Protocol

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Vmware Spring Advanced Message Queuing Protocol: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol

CVE-2026-41714 Média · 4.0 CWE-295 09/06/2026

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

CVE-2026-41701 Média · 4.4 CWE-330 09/06/2026

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.