Package "rabbitmq-server"

rabbitmq-server (3.9.27-0ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: CORS misconfiguration
    - debian/patches/CVE-2026-66070.patch: fix CORS wildcard origin
      reflecting credentials in rabbit_mgmt_cors.erl
    - CVE-2026-66070
  * SECURITY UPDATE: Stored XSS
    - debian/patches/CVE-2026-66077.patch: fix stored XSS via TLS
      peer-certificate DN in management UI connection.ejs
    - CVE-2026-66077
  * SECURITY UPDATE: Pre-auth denial of service
    - debian/patches/CVE-2026-66079.patch: fix pre-auth AMQP 1.0 array32
      zero-width element DoS in amqp10_binary_parser.erl
    - CVE-2026-66079
  * SECURITY UPDATE: TLS authentication bypass
    - debian/patches/CVE-2026-67231_1.patch: fix TLS client-auth bypass
      in trust-store plugin using SHA-256 cert fingerprint
    - CVE-2026-67231
  * SECURITY UPDATE: Pre-auth denial of service
    - debian/patches/CVE-2026-67232.patch: set Cowboy max_frame_size for
      Web MQTT and Web STOMP to prevent zlib bomb DoS
    - CVE-2026-67232
  * SECURITY UPDATE: Unbounded memory allocation
    - debian/patches/CVE-2026-67235.patch: validate content-header body size
      against max_message_size in rabbit_command_assembler.erl
    - CVE-2026-67235
  * SECURITY UPDATE: Cleartext credential storage
    - debian/patches/CVE-2026-67236.patch: remove insecure auth cookie
      storing base64-encoded credentials without HttpOnly/Secure flags
    - CVE-2026-67236
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-67238.patch: use binary_to_existing_atom
      instead of binary_to_atom in pid_recomposition.erl to prevent
      atom table exhaustion DoS
    - CVE-2026-67238
  * SECURITY UPDATE: Stored XSS
    - debian/patches/CVE-2026-67239_1.patch: fix stored XSS via TLS
      peer-certificate DN in stream management UI streamConnection.ejs
    - debian/patches/CVE-2026-67239_2.patch: apply fmt_string to more
      rendered values in streamConnection.ejs
    - CVE-2026-67239
  * SECURITY UPDATE: Authentication denial of service
    - debian/patches/CVE-2026-67409.patch: validate HTTP response status
      code when fetching JWKS keys to prevent auth DoS
    - CVE-2026-67409

 -- Leonidas Da Silva Barbosa Tue, 06 Oct 2026 13:54:09 -0300

rabbitmq-server (3.9.27-0ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Allocation of resources without limits
    - debian/patches/CVE-2026-59248.patch: add a hard limit for HPACK
      integer decoding in bundled cowlib to prevent memory exhaustion
      via crafted HPACK/QPACK prefixed-integer encoding.
    - CVE-2026-59248

 -- Leonidas Da Silva Barbosa Tue, 29 Sep 2026 07:43:51 -0300

  rabbitmq-server (3.9.27-0ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: XSS vulnerability
    - debian/patches/CVE-2025-30219.patch: sanitize error message in
      management ui.
    - CVE-2025-30219

 -- Fabian Toepfer <email address hidden> Thu, 27 Mar 2025 17:08:12 +0100

  rabbitmq-server (3.9.27-0ubuntu0.1) jammy; urgency=medium

  * New upstream version 3.9.27 (LP: #2060248):
    - In environments where DNS resolution is not yet available at the time
      RabbitMQ nodes boot and try to perform peer discovery, such as CoreDNS
      with default caching interval of 30s on Kubernetes, nodes now will
      retry hostname resolution (including of their own host) several times
      with a wait interval.
    - LDAP server password could end up in the logs in certain types of
      exceptions.
    - Details about these and many futher changes can be found at
      https://github.com/rabbitmq/rabbitmq-server/blob/main/release-notes/3.9.27.md
      and earlier versions in the same folder.
  * Added new dep8 tests (LP: #1679386):
    - d/t/hello-world
    - d/t/publish-subscribe
    - d/t/rpc
    - d/t/work-queue
  * Packaging changes needed by this update:
    - d/watch: update to find upstream tarball, and verify its signature.
    - d/upstream/signing-key.asc: added, downloaded from
      https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc
    - Remove patches fixed upstream:
      - d/p/lp1999816-fix-rabbitmqctl-status-disk-free-timeout.patch.
    - d/p/CVE-2023-46118-{1,2}.patch: fix fuzz.
    - d/p/lets-use-python3-not-python-binary.patch: refresh.
    - d/p/downgrade_elixir.patch: downgrade the allowed elixir version minimum
      to 1.12.2 to allow Jammy to run. Upstream upgrades the minimum for general
      compiler optimizations, but is too recent for us.
    - d/p/max-ports-compat.patch: before v3.9.23, the maximum number of
      concurrent client connections was set based on the kernel open file handle
      limit. In v3.9.23 the concurrent client connection limit was changed to
      the value of the ERL_MAX_PORTS environment variable, and defaults to 65536
      if the variable is not set. To not change the behavior in upgrades to this
      version, this patch sets ERL_MAX_PORTS to the kernel open file handle
      limit if the variable is not set already. If the variable is set,
      then it's left alone. Note that ERL_MAX_PORTS must never be higher than
      the kernel open file handle limit.
    - d/rabbitmq-server.service: add notice about ERL_MAX_PORTS variable.
  * d/p/0007-Correctly-decrease-global-counters-in-rabbit_channel.patch: Fix
    errors in rabbitmq_global_publishers and rabbitmq_global_consumers counters
    (LP: #2073932).

 -- Mitchell Dzurick <email address hidden> Thu, 04 Apr 2024 12:54:06 -0700

  rabbitmq-server (3.9.13-1ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2023-46118-*.patch: Introduce HTTP request body limit
      for definition uploads and Reduce default HTTP API request body size limit
      to 10 MiB in deps/rabbitmq_management/Makefile, include/rabbit_mgmt.hrl,
      priv/schema/rabbitmq_management.schema, src/rabbit_mgmt_util.erl,
      src/rabbit_mgmt_wm_definitions.erl.
    - CVE-2023-46118

 -- Leonidas Da Silva Barbosa <email address hidden> Mon, 06 Nov 2023 09:22:43 -0300