[SECURITY] Fedora 40 Update: voms-api-java-3.3.2-16.fc40

The Virtual Organization Membership Service VOMS is an attribute authority which serves as central repository for VO user authorization information, providing support for sorting users into group hierarchies, keeping track of their roles and other attributes in order to issue trusted attribute...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in RabbitMQ Java Client [CVE-2023-46120]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in RabbitMQ Java Client, caused by no message size limit in maxBodyLebgth. CVE-2023-46120. RabbitMQ is a database used in one of our Speech microservices. This vulnerabilitiy has been...

The vulnerability of the client software’s interaction with the RabbitMQ Java client, a broker for messaging services, arises from uncontrolled resource consumption. This allows attackers to cause service failures.

The vulnerability of the client software for interacting with the RabbitMQ Java client for message brokers involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in RabbitMQ Java Client

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of RabbitMQ Java Client. Vulnerability Details CVEID: CVE-2023-46120 DESCRIPTION: RabbitMQ Java Client is vulnerable to a denial of service, caused by no message size limit in maxBodyLebgth. By sending...

SUSE CVE-2023-46120

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

CVE-2023-46120

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

Memory corruption

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

RabbitMQ Resource Management Error Vulnerability

RabbitMQ is a feature-rich multi-protocol messaging and streaming agent from RabbitMQ open source. A security vulnerability exists in the RabbitMQ Java client versions prior to 5.18.0 that stems from allowing Java and JVM-based applications to connect to and interact with RabbitMQ nodes, where an...

CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

CVE-2023-46120

CVE-2023-46120 affects the RabbitMQ Java Client. The issue arises because maxBodyLebgth was not used when receiving Message objects, allowing an attacker to send a very large Message that could cause memory overflow and DoS/OOM in the consumer. The vulnerability is patched in RabbitMQ Java Client...

CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may...

GHSA-MM8H-8587-P46H RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

Summary maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error. PoC RbbitMQ Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M here it only needs to be larger than the Consumer memo...

PT-2023-8230 · Rabbitmq +1 · Rabbitmq Java Client +1

Name of the Vulnerable Software and Affected Versions: RabbitMQ Java client versions prior to 5.18.0 Description: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects...

The vulnerability of the Java client of the Aerospike Database management system allows a hacker to execute arbitrary code.

The vulnerability of the Java client of the Aerospike Database management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

CVE-2023-36480

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them...

CVE-2023-36480 Aerospike Java Client vulnerable to unsafe deserialization of server responses

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them...

CVE-2023-36480

CVE-2023-36480 affects the Aerospike Java Client. The vulnerability arises from unsafe deserialization of server-provided data: messages may contain Java objects that the client deserializes via JBLOB payloads using Java’s ObjectInputStream, without sufficient validation. This can lead to Remote ...

CVE-2023-36480 Aerospike Java Client vulnerable to unsafe deserialization of server responses

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them...

CVE-2023-36480 Aerospike Java Client vulnerable to unsafe deserialization of server responses

The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them...