Lucene search

K
osvGoogleOSV:SUSE-FU-2024:2078-1
HistoryJun 19, 2024 - 3:36 a.m.

Feature update for rabbitmq-server313, erlang26, elixir115

2024-06-1903:36:36
Google
osv.dev
1
rabbitmq-server313
erlang26
elixir115
security vulnerabilities
bugs
rpm package
dos attacks
javascript code execution
encryption key
http api vulnerability
rabbitmq maintenance
systemd service
user/group
upstream changes.

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

This update for rabbitmq-server313, erlang26, elixir115 fixes the following issues:

rabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 (jsc#PED-8414):

  • Security issues fixed:

    • CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice (DoS) attacks (bsc#1186203)
    • CVE-2021-32718, CVE-2021-32719: Fixed potential for JavaScript code execution in the management UI
      (bsc#1187818, bsc#1187819)
    • CVE-2022-31008: Fixed encryption key used to encrypt the URI was seeded with a predictable secret (bsc#1205267)
    • CVE-2023-46118: Fixed HTTP API vulnerability for denial of service (DoS) attacks with very large messages
      (bsc#1216582)
  • Other bugs fixed:

    • Fixed RabbitMQ maintenance status issue (bsc#1199431)
    • Provide user/group for RPM 4.19 (bsc#1219532)
    • Fixed rabbitmqctl command for add_user (bsc#1222591)
    • Added hardening to systemd service(s) (bsc#1181400)
    • Use /run instead of deprecated /var/run in tmpfiles.conf (bsc#1185075)
  • For the full list of upstream changes of this update between version 3.8.11 and 3.13.1 please consult:

erlang26:

  • Provide RPM package as it’s a dependency of rabbitmq-server313 (jsc#PED-8414)

elixir115:

  • Provide RPM package as needed in some cases by rabbitmq-server313 (jsc#PED-8414)

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High