Spring Framework Unsafe Deserialization Vulnerability via Jackson JMS Converters

A vulnerability exists in the Spring Framework within the Jackson JMS message converters, specifically in versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. In an untrusted JMS environment, these converters permit arbitrary class instantiation, potentially leading to unauthorized actions through gadget class deserialization.

Impact

Exploitation of this vulnerability could result in unsafe deserialization, allowing for arbitrary class instantiation and potentially leading to unauthorized actions within the application.

Remediation

Users in a trusted JMS environment do not need to take any action. For those in an untrusted JMS environment, it is recommended to upgrade to the fixed version and limit authorized packages for deserialization using the new 'setTrustedPackages' methods. The fixed versions are 7.0.8, 6.2.19, 6.1.28, and 5.3.49.