Bug 2246512 (CVE-2023-46118) - CVE-2023-46118 rabbitmq-server: DoS by publishing large messages over the HTTP API
Summary: CVE-2023-46118 rabbitmq-server: DoS by publishing large messages over the HTT...
Keywords:
Status: NEW
Alias: CVE-2023-46118
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2246538 2246539 2246522 2246523 2246524
Blocks: 2246529
TreeView+ depends on / blocked
 
Reported: 2023-10-27 07:11 UTC by TEJ RATHI
Modified: 2024-01-16 14:35 UTC (History)
10 users (show)

Fixed In Version: rabbitmq-server 3.12.7, rabbitmq-server 3.11.24
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the rabbitmq-server. An authenticated user with sufficient credentials can publish very large messages over the HTTP API and cause the target node to be terminated by an "out-of-memory killer" like mechanism.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:0217 0 None None None 2024-01-16 14:35:56 UTC

Description TEJ RATHI 2023-10-27 07:11:33 UTC 
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg
Comment 2 Avinash Hanwate 2023-10-27 09:23:07 UTC 
Created rabbitmq-server tracking bugs for this issue:

Affects: epel-all [bug 2246539]
Affects: fedora-all [bug 2246538]
Comment 3 errata-xmlrpc 2024-01-16 14:35:55 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1

Via RHSA-2024:0217 https://access.redhat.com/errata/RHSA-2024:0217
Note You need to log in before you can comment on or make changes to this bug.