Multiple vulnerabilities patched in RabbitMQ Server on Ubuntu
Key Takeaway
Ubuntu has released security updates for RabbitMQ Server to address several vulnerabilities including DoS, XSS, and authentication bypasses.
Summary
Ubuntu has issued security notice USN-8933-1 to address a series of vulnerabilities in RabbitMQ Server. These flaws affect various Ubuntu LTS releases and could allow attackers to perform cross-site scripting (XSS), cross-site request forgery (CSRF), denial of service (DoS), or bypass TLS authentication. Users are advised to update their packages and restart the rabbitmq-server service.
Vulnerability details
- Denial of Service (DoS): Caused by incorrect handling of AMQP 1.0 arrays, WebSocket frame sizes, content-header body sizes, ETF-encoded PID node names, and JWKS key fetching.
- Cross-Site Scripting (XSS): Found in the management UI via TLS peer-certificate DNs, stream management UI, and OAuth bearer tokens in bootstrap JavaScript.
- Authentication/Authorization Bypasses: Includes TLS client authentication bypass via the trust-store plugin and TLS verification bypass in OAuth2 SSL options.
- Information Exposure/CSRF: Issues involving insecure cookie storage for credentials and incorrect CORS wildcard origin configuration.
Why it matters
Users running RabbitMQ on Ubuntu LTS versions should apply these updates immediately to prevent potential service disruptions or unauthorized access.
What to do
- Update RabbitMQ Server packages on affected Ubuntu LTS releases using standard package management tools.
- Restart the rabbitmq-server service after applying the updates.
Original reference: ubuntu.com →