Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:4939-1

Опубликовано: 20 дек. 2023
Источник: suse-cvrf

Описание

Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues:

  • CVE-2023-46118: Introduce HTTP request body limit for definition uploads (bsc#1216582).

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15 SP4
erlang-rabbitmq-client-3.8.11-150300.3.14.1
rabbitmq-server-3.8.11-150300.3.14.1
rabbitmq-server-plugins-3.8.11-150300.3.14.1
SUSE Linux Enterprise Module for Server Applications 15 SP5
erlang-rabbitmq-client-3.8.11-150300.3.14.1
rabbitmq-server-3.8.11-150300.3.14.1
rabbitmq-server-plugins-3.8.11-150300.3.14.1
openSUSE Leap 15.4
erlang-rabbitmq-client-3.8.11-150300.3.14.1
rabbitmq-server-3.8.11-150300.3.14.1
rabbitmq-server-plugins-3.8.11-150300.3.14.1
openSUSE Leap 15.5
erlang-rabbitmq-client-3.8.11-150300.3.14.1
rabbitmq-server-3.8.11-150300.3.14.1
rabbitmq-server-plugins-3.8.11-150300.3.14.1

Ссылки

Описание

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP4:erlang-rabbitmq-client-3.8.11-150300.3.14.1
SUSE Linux Enterprise Module for Server Applications 15 SP4:rabbitmq-server-3.8.11-150300.3.14.1
SUSE Linux Enterprise Module for Server Applications 15 SP4:rabbitmq-server-plugins-3.8.11-150300.3.14.1
SUSE Linux Enterprise Module for Server Applications 15 SP5:erlang-rabbitmq-client-3.8.11-150300.3.14.1
Ссылки