Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
Fixed upstream in RabbitMQ 4.2.5 (commit 33dedfe4fd53ff009cc67ab36358d0624c6b2e53). Fedora status: - rawhide (4.3.3) and f44 (4.2.9) already ship >= 4.2.5 and contain the fix. - f43 (4.0.9): the upstream 4.0.x line is EOL with no fixed 4.0.x release, so the fix has been backported onto 4.0.9. Build in progress.
FEDORA-2026-548235ea3b (rabbitmq-server-4.0.9-5.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-548235ea3b
FEDORA-2026-548235ea3b has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-548235ea3b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-548235ea3b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-548235ea3b (rabbitmq-server-4.0.9-5.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.