Pivotal RabbitMQ is vulnerable to a denial of service attack
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
>= 3.7.0, < 3.7.21
>= 3.8.0, < 3.8.1
< 1.16.7
>= 1.17.0, < 1.17.4
Patched versions
3.7.21
3.8.1
1.16.7
1.17.4
Description
Published by the National Vulnerability Database
Nov 23, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jul 1, 2022
Last updated
Jan 27, 2023
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
References