CVE-2018-11087— TLS validation error
Quick assessment
Affected
Pivotal Spring AMQP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pivotal Spring AMQP是美国Pivotal Software公司的一套基于Spring框架的AMQP消息解决方案。该产品主要提供模板化的发送和接收消息的抽象层，并提供基于消息驱动的POJO的消息监听等功能。 Pivotal Spring AMQP 1.7.10之前的1.x版本和2.0.6之前的2.x版本中存在安全漏洞，该漏洞程序没有验证主机名称。攻击者可通过实施中间人攻击利用该漏洞查看传递的数据。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-11087
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TLS validation error
Source: CVE Program / CVE List V5
Vulnerability Description
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Pivotal Spring AMQP 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pivotal Spring AMQP是美国Pivotal Software公司的一套基于Spring框架的AMQP消息解决方案。该产品主要提供模板化的发送和接收消息的抽象层，并提供基于消息驱动的POJO的消息监听等功能。 Pivotal Spring AMQP 1.7.10之前的1.x版本和2.0.6之前的2.x版本中存在安全漏洞，该漏洞程序没有验证主机名称。攻击者可通过实施中间人攻击利用该漏洞查看传递的数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pivotal | Spring AMQP | 1.x ~ 1.7.10 | - |
|
II. Public POCs for CVE-2018-11087
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-11087
请登录查看更多情报信息。
Other References for CVE-2018-11087 (1)
-
https://pivotal.io/security/cve-2018-11087 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: Spring AMQP
-
CVE-2026-59320
In Spring AMQP the link credit never replenished on listener -
CVE-2026-59272
Log4j2 AmqpAppender disables TLS hostname verification by de -
CVE-2026-59275
Remote JVM termination: nested-array Java deserialization by -
CVE-2026-59271
Admin password disclosed in BrokerNotAliveException message -
CVE-2026-47860
Unbounded decompression of attacker-supplied compressed mess
Same vendor: Pivotal
-
CVE-2020-5409
Concourse Open Redirect in the /sky/login endpoint -
CVE-2020-5406
PCF Autoscaling logs its database credentials -
CVE-2020-5403
DoS Via Malformed URL with Reactor Netty HTTP Server -
CVE-2020-5404
Authentication Leak On Redirect With Reactor Netty HttpClien -
CVE-2019-11288
tcServer JMX Socket Listener Registry Rebinding Local Privil
V. Comments for CVE-2018-11087
No comments yet