Описание
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
A flaw was found in rabbitmq-server. When clearing authentication preferences, the server generates a non-compliant cookie name containing invalid characters that standard web browsers reject when attempting deletion. This issue prevents the browser from properly removing the cookie, allowing stale authentication-mechanism preferences to unintentionally persist across logout and login cycles.
Отчет
Red Hat has evaluated this issue as having Low severity because it is limited to maintaining client-side authentication mechanism settings and cannot be leveraged for arbitrary code execution, privilege escalation, or unauthorized data access. The problem is isolated to the RabbitMQ web management interface during session cookie clearance, where non-standard response formatting causes browsers to retain the preference cookie. As a result, typical message broker operations and backend message routing remain unaffected, with security impact confined to unintended authentication option persistence across user login cycles.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | rabbitmq-server4.2 | Fix deferred | ||
| Red Hat OpenStack Platform 13 (Queens) | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 16.2 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 17.1 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 18.0 | rabbitmq-server | Fix deferred | ||
| Red Hat Hardened Images | rabbitmq-server4-3-main-4.3.6-1.hum1 | Fixed | RHSA-2026:67552 | 15.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
3.1 Low
CVSS3
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution or data exfiltration; its security relevance is limited to stale authentication-mechanism preferences persisting across logout and login cycles. This issue is fixed in versions 4.2.8 and 4.3.2.
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 a ...
3.1 Low
CVSS3