On behalf of the RabbitMQ team I'm happy to announce that the RabbitMQ
Java Client library 5.7.1 is available.
This patch release fixes a bug in the NIO mode and bumps an optional
dependency to address a vulnerability [1]. If you don't use Jackson in
the Java client JSON RPC support, you're not affected by this
vulnerability. Consult the release changes for more details [2].
All users of the 5.x.x series are encouraged to upgrade to 5.7.1.
Changes:
* Handle exception in NIO loop to avoid abrupt termination
* Bump Jackson to 2.9.9
Dependency (Maven artifact)
Maven:
<dependency>
<groupId>com.rabbitmq</groupId>
<artifactId>amqp-client</artifactId>
<version>5.7.1</version>
</dependency>
Gradle:
compile 'com.rabbitmq:amqp-client:5.7.1'
[1]
https://nvd.nist.gov/vuln/detail/CVE-2019-12086
[2]
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.7.1