p PatchFirst

CVE-2019-11287

CVE-2019-11287 · RabbitMQ Web Management Plugin DoS via heap overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

CVSS 4.5 · Medium · EPSS 4.4% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • rabbitmq for pivotal platform

    Versions
    • ≥ 1.16, < 1.16.7: Affected (custom)
    • ≥ 1.17, < 1.17.4: Affected (custom)

    Update to 1.16.7; Update to 1.17.4

  • rabbitmq

    Versions
    • ≥ 3.7, < v3.7.21: Affected (custom)
    • ≥ 3.8, < v3.8.1: Affected (custom)

    Update to v3.7.21; Update to v3.8.1

  • rabbitmq-server Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

  • rabbitmq-server Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

  • rabbitmq-server Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.8.3-1

    Update to 3.8.3-1

  • rabbitmq-server Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.4-1
    • 3.5.4-3
    • 3.5.4-3.1
    • 3.5.7-1
    • 3.5.7-1ubuntu0.16.04.1
    • 3.5.7-1ubuntu0.16.04.2
    • 3.5.7-1ubuntu0.16.04.4
    Affected ranges
    • ECOSYSTEM: < 3.5.7-1ubuntu0.16.04.4+esm1

    Update to 3.5.7-1ubuntu0.16.04.4+esm1

  • rabbitmq-server Ubuntu:18.04:LTS

    Versions
    • 3.6.10-1
    • 3.6.10-1ubuntu0.1
    • 3.6.10-1ubuntu0.3
    • 3.6.10-1ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 3.6.10-1ubuntu0.5

    Update to 3.6.10-1ubuntu0.5

Original sources

Check your server →