|
rabbitmq-server (4.0.5-10ubuntu5.2) resolute-security; urgency=medium
* SECURITY UPDATE: CORS misconfiguration
- debian/patches/CVE-2026-66070.patch: fix CORS wildcard origin
reflecting credentials in rabbit_mgmt_cors.erl
- CVE-2026-66070
* SECURITY UPDATE: Stored XSS
- debian/patches/CVE-2026-66077.patch: fix stored XSS via TLS
peer-certificate DN in management UI connection.ejs
- CVE-2026-66077
* SECURITY UPDATE: Pre-auth denial of service
- debian/patches/CVE-2026-66079.patch: fix pre-auth AMQP 1.0 array32
zero-width element DoS in amqp10_binary_parser.erl
- CVE-2026-66079
* SECURITY UPDATE: TLS authentication bypass
- debian/patches/CVE-2026-67231_1.patch: fix TLS client-auth bypass
in trust-store plugin using SHA-256 cert fingerprint
- CVE-2026-67231
* SECURITY UPDATE: Pre-auth denial of service
- debian/patches/CVE-2026-67232.patch: set Cowboy max_frame_size for
Web MQTT and Web STOMP to prevent zlib bomb DoS
- CVE-2026-67232
* SECURITY UPDATE: Unbounded memory allocation
- debian/patches/CVE-2026-67235.patch: validate content-header body size
against max_message_size in rabbit_command_assembler.erl
- CVE-2026-67235
* SECURITY UPDATE: Cleartext credential storage
- debian/patches/CVE-2026-67236.patch: remove insecure auth cookie
storing base64-encoded credentials without HttpOnly/Secure flags
- CVE-2026-67236
* SECURITY UPDATE: Reflected XSS
- debian/patches/CVE-2026-67237.patch: fix reflected XSS via OAuth
bootstrap JS by escaping bearer token with JSON encoding
- CVE-2026-67237
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2026-67238.patch: use binary_to_existing_atom
instead of binary_to_atom in pid_recomposition.erl to prevent
atom table exhaustion DoS
- CVE-2026-67238
* SECURITY UPDATE: Stored XSS
- debian/patches/CVE-2026-67239_1.patch: fix stored XSS via TLS
peer-certificate DN in stream management UI streamConnection.ejs
- debian/patches/CVE-2026-67239_2.patch: apply fmt_string to more
rendered values in streamConnection.ejs
- CVE-2026-67239
* SECURITY UPDATE: TLS verification bypass
- debian/patches/CVE-2026-67404.patch: keep verify_peer when no CA
certs available in oauth2_client.erl instead of falling back to
verify_none
- CVE-2026-67404
* SECURITY UPDATE: Authentication denial of service
- debian/patches/CVE-2026-67409.patch: validate HTTP response status
code when fetching JWKS keys to prevent auth DoS
- CVE-2026-67409
-- Leonidas Da Silva Barbosa Tue, 06 Oct 2026 13:54:06 -0300
|
| CVE-2026-66070 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin |
| CVE-2026-66077 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... % |
| CVE-2026-66079 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (lis |
| CVE-2026-67231 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_f |
| CVE-2026-67232 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 s |
| CVE-2026-67235 |
RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was |
| CVE-2026-67236 |
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie |
| CVE-2026-67237 |
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization heade |
| CVE-2026-67238 |
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ET |
| CVE-2026-67239 |
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificat |
| CVE-2026-67404 |
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_option |
| CVE-2026-67409 |
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Co |
|
