Package: rabbitmq-server Version: 3.3.5-1 Severity: important
RabbitMQ 3.4.1 fixes a couple of bugs in the management plugin that may have security implications. These can probably be considered less severe than the bug described here: https://groups.google.com/forum/#!topic/rabbitmq-users/DMkypbSvIyM (which was fixed in 3.4.0). From the release notes: 26437 prevent /api/* from returning text/html error messages which could act as an XSS vector (since 2.1.0) 26433 fix response-splitting vulnerability in /api/downloads (since 2.1.0) Bug 26437 allowed an attacker to create a URL to "/api/..." which would provoke an internal server error, resulting in the server returning an html page with text from the URL embedded and not escaped. This was fixed by ensuring all URLs below /api/ only ever return responses with a content type of application/json, even in the case of an internal server error. Bug 26433 allowed an attacker to specify a URL to /api/definitions which would cause an arbitrary additional header to be returned. This was fixed by stripping out CR/LF from the "download" query string parameter. Above text from: https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
