Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-cuf7-182f-9ubm

Summary

Improper Certificate Validation
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

Aliases

alias	CVE-2018-11087

alias	GHSA-w4g2-9hj6-5472

Fixed_packages

url	pkg:maven/com.rabbitmq/amqp-client@4.8.0
purl	pkg:maven/com.rabbitmq/amqp-client@4.8.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.rabbitmq/amqp-client@4.8.0

url	pkg:maven/com.rabbitmq/amqp-client@5.4.0
purl	pkg:maven/com.rabbitmq/amqp-client@5.4.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.rabbitmq/amqp-client@5.4.0

url	pkg:maven/org.springframework.amqp/spring-amqp@1.7.10
purl	pkg:maven/org.springframework.amqp/spring-amqp@1.7.10
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.amqp/spring-amqp@1.7.10

Affected_packages

url pkg:maven/com.rabbitmq/amqp-client@5.0.0

purl pkg:maven/com.rabbitmq/amqp-client@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-cuf7-182f-9ubm

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.rabbitmq/amqp-client@5.0.0

References

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-11087
reference_id	CVE-2018-11087
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-11087

reference_url	https://pivotal.io/security/cve-2018-11087
reference_id	CVE-2018-11087
reference_type
scores
url	https://pivotal.io/security/cve-2018-11087

reference_url	https://github.com/advisories/GHSA-w4g2-9hj6-5472
reference_id	GHSA-w4g2-9hj6-5472
reference_type
scores
url	https://github.com/advisories/GHSA-w4g2-9hj6-5472

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	295
name	Improper Certificate Validation
description	The product does not validate, or incorrectly validates, a certificate.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cuf7-182f-9ubm

Vulnerability Instance