[SECURITY] [DLA 2710-1] rabbitmq-server security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2710-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
July 19, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : rabbitmq-server
Version : 3.6.6-1+deb9u1
CVE ID : CVE-2017-4965 CVE-2017-4966 CVE-2017-4967 CVE-2019-11281
CVE-2019-11287 CVE-2021-22116
Several vulnerabilities were discovered in rabbitmq-server, a
message-broker software.
CVE-2017-4965
Several forms in the RabbitMQ management UI are vulnerable to XSS
attacks.
CVE-2017-4966
RabbitMQ management UI stores signed-in user credentials in a
browser's local storage without expiration, making it possible to
retrieve them using a chained attack
CVE-2017-4967
Several forms in the RabbitMQ management UI are vulnerable to XSS
attacks.
CVE-2019-11281
The virtual host limits page, and the federation management UI,
which do not properly sanitize user input. A remote authenticated
malicious user with administrative access could craft a cross site
scripting attack that would gain access to virtual hosts and
policy management information
CVE-2019-11287
The "X-Reason" HTTP Header can be leveraged to insert a malicious
Erlang format string that will expand and consume the heap,
resulting in the server crashing.
CVE-2021-22116
A malicious user can exploit the vulnerability by sending
malicious AMQP messages to the target RabbitMQ instance.
For Debian 9 stretch, these problems have been fixed in version
3.6.6-1+deb9u1.
We recommend that you upgrade your rabbitmq-server packages.
For the detailed security status of rabbitmq-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rabbitmq-server
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAmD1tJkACgkQhj1N8u2c
KO8lIg//f/LcL1AyTtnwyXh5MMCs7OfZ2U4oychwStzEnZ5D7LAoblb9g97Inw15
KYRQOD/CU/TxokDgMP8x5TzJNyq4/exJi5/Ergyx1TinBNP/6QJB5QeTYp94OZrL
l1nbI5xDDaNnyf1mnMJ04lk/sXAfMp19zeCIXy28SLSyVz0PivgOW+SARl5yEFpW
U6QGy4wzkiDAVdqo8JPxF7H4wTCZEJxgQcBMrIUSTGxsHW9CZh6IiOEyz7DziH3Y
YWYXFqZIkdJyQxWX6ukMysTLnb/fg6Fndt+cyXiHFvhjZH6IRu2LKXsVC6h3RJJh
8DTZgQS5Vy9g2wvuljiG5C8KQtijZ9vc1qMWELRnN7I1owcCRqUIUIxm9p/XfJLz
4p1ic9c8nMd55Gsi97SqEbSLKAR2Wkw2HePu8cmN48WCF2esB9xvyI2GSa7SHUov
FIX+DwNV4gnuzE+BnQGvhpTpL1Cwpwwtmhvp9lJmf5b2z00ltlGfzPG/4jy6KLK0
ce+5yaGWsUAVP0r0UU8jfFfNfp/VqbcD1ijB3Dr2VEEkKSipXuKuv61ceA42qTgl
X/cEOtZG8yW+jVU5ndFKnP/4AuQxqJWWPDeW2DzgeH4b6lzTjdZeh9g8Qu+kKju4
SkB0jkWEAm8Md3eYgrKB9cStN/uPZU7ni7Z/c0Xt1J/Jrv67GnM=
=rAJ1
-----END PGP SIGNATURE-----
Reply to: