Bug 2246512 (CVE-2023-46118)

Summary:	CVE-2023-46118 rabbitmq-server: DoS by publishing large messages over the HTTP API
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, eglynn, jeckersb, jjoyce, jschluet, lhh, mburns, mgarciac, pgrist, plemenko
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rabbitmq-server 3.12.7, rabbitmq-server 3.11.24	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the rabbitmq-server. An authenticated user with sufficient credentials can publish very large messages over the HTTP API and cause the target node to be terminated by an "out-of-memory killer" like mechanism.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2246539, 2246522, 2246523, 2246524, 2246538
Bug Blocks:	2246529

Description TEJ RATHI 2023-10-27 07:11:33 UTC

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg

Comment 2 Avinash Hanwate 2023-10-27 09:23:07 UTC

Created rabbitmq-server tracking bugs for this issue:

Affects: epel-all [bug 2246539]
Affects: fedora-all [bug 2246538]

Comment 3 errata-xmlrpc 2024-01-16 14:35:55 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1

Via RHSA-2024:0217 https://access.redhat.com/errata/RHSA-2024:0217