RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

🗓️ 24 Oct 2023 01:49:09Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 30 Views

RabbitMQ Java client's Lack of Message Size Limitation leading to Remote DoS Attac

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager November 2023 - Multiple CVEs addressed	15 Nov 202313:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in RabbitMQ Java Client affects IBM watsonx.data	25 Sep 202419:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in RabbitMQ Java Client	29 Nov 202314:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM QRadar SIEM RabbitMQ protocol is vulnerable to a denial of service (CVE-2023-46120)	10 May 202415:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang Go and RabbitMQ Java Client might affect IBM Storage Copy Data Management	14 Jun 202416:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in RabbitMQ Java Client [CVE-2023-46120]	31 Jan 202423:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data 4.8.1 has addressed security vulnerabilities	26 Dec 202321:15	–	ibm
Chainguard	CVE-2023-46120 vulnerabilities	25 Oct 202318:17	–	cgr
Circl	CVE-2023-46120	23 Oct 202310:35	–	circl

Vulners

Node

com.rabbitmq amqp-clientRange<5.18.0maven

Source	Link
github	www.github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
github	www.github.com/rabbitmq/rabbitmq-java-client/issues/1062
github	www.github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
github	www.github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-46120
github	www.github.com/advisories/GHSA-mm8h-8587-p46h

05 Nov 2023 05:04Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.14.9 - 7.5

EPSS0.01095

SSVC

rabbitmq java message size remote dos memory overflow oom error dos attacks consumer memory