RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Affected: openEuler:24.03-LTS-SP4: rabbitmq-server

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)

RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in…

Security update for rabbitmq-server

rabbitmq: RabbitMQ: Information disclosure via path validation bypass in management plugin rabbitmq-server: RabbitMQ: Denial of Service via oversized JSON bodies in HTTP API rabbitmq-server: RabbitMQ: Information Disclosure via Cross-Site Scripting in Federation Management RabbitMQ: RabbitMQ: Cross-site Scripting in management UI allows arbitrary JavaScript execution RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing rabbitmq: RabbitMQ: Authentication bypass allows remote connection for loopback-restricted users via incorrect loopback check rabbitmq: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames RabbitMQ: RabbitMQ: Information disclosure via authorization bypass in AMQP 0-9-1 operations

Security update for rabbitmq-server

Affected: Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:18.04:LTS: rabbitmq-server, Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server, Ubuntu:26.04:LTS: rabbitmq-server

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Daten zu manipulieren, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.