Patchfirst
Patchfirst
CVE-2018-11087 EPSS 1.2%

TLS validation error

Pivotal · Spring AMQP

Official description · CVE.org

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

Breakdown
13.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

Disclosed on 14 Sep 2018. No public exploit code or confirmed exploitation is recorded.

6 fixes in spring-amqp over 9 years. The latest fix listed for spring-amqp is 4.0.4.

Fixes in spring-amqpMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.5.5CVE-2016-217321 Apr 2017
  2. 1.7.4CVE-2017-804527 Nov 2017
  3. 2.0.6CVE-2018-1108714 Sep 2018
  4. 2.3.11CVE-2021-2209728 Oct 2021
  5. 2.3.11CVE-2021-2209530 Nov 2021
  6. 4.0.4CVE-2026-417019 Jun 2026Latest listed

techniques

1 , grouped by in kill-chain order 1

Credential AccessTA0006

Adversary-in-the-Middle T1557 also Collection
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 10 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-11087 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Adversary-in-the-MiddleT155710 general rules
All 10 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.springframework.amqp:spring-amqp.

Mavenorg.springframework.amqp:spring-amqpGHSA-w4g2-9hj6-5472

Upgrade to 2.0.6 or later

Set the version to 2.0.6 or later in your pom.xml or build.gradle.

The first fix for CVE-2018-11087. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
2.0.0 up to 2.0.62.0.6
All versions before 1.7.101.7.10

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavencom.rabbitmq:amqp-client
    Affected: 5.0.0 up to 5.4.0; All versions before 4.8.0Upgrade to 5.4.0 or later (older lines: 4.8.0)
    GHSA-w4g2-9hj6-5472

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

pivotal.io/security/cve-2018-11087
↑ ↓ chooseEnter openEsc close