RabbitMQ 4.2.5 Advisory: Multiple Component Crashes and Defect Fixes

RabbitMQ 4.2.5 Vulnerability Summary Vulnerability Overview RabbitMQ 4.2.5 is a maintenance release that addresses multiple critical vulnerabilities, including issues in classic queues, Quorum queues, peer discovery, definition imports, decorator callbacks, Mnesia to Khepri migration, configuration, the function, , request body size limits, API endpoint validation, queue API responses, CLI tools, the Federation Management plugin, Prometheus plugin, Grafana dashboard, Shovel plugin, and the Web STOMP plugin. Impact Scope Classic Queues: Queues may terminate and restart under specific conditions. Quorum Queues: Messages may be incorrectly rejected during the deletion process. Peer Discovery: A crash may occur when returns an empty list. Definition Imports: UTF-8 BOM is stripped from input files if present. Decorator Callbacks: Exceptions in policy change notifications are now logged instead of being silently suppressed. Mnesia to Khepri Migration: Migration throughput has been improved. : Additional settings have been added, and the polling interval has been configured. : Crashes may occur when receiving zero-sized frames. : Crashes may occur when stream declaration fails. Request Body Size Limits: Requests exceeding the configured maximum limit are now rejected earlier. API Endpoint Validation: Validation for multiple API endpoints has been improved. Queue API Responses: Responses now include policy-related fields. CLI Tools: and may crash in maintenance mode. Federation Management Plugin: The and parameter values are now correctly escaped. Prometheus Plugin: The and metadata lines for Raft metrics are no longer generated repeatedly. Grafana Dashboard: The "TCP sockets available" panel has been replaced with the "File descriptors available" panel. Shovel Plugin: Exceptions may be thrown when declaring a dynamic shovel. Web STOMP Plugin: The heartbeat monitoring process may cause a crash when connections are closed. Remediation Classic Queues: Fixed the issue where queues terminate and restart. Quorum Queues: Fixed the issue where messages were incorrectly rejected during deletion. Peer Discovery: Fixed the crash issue when returns an empty list. Definition Imports: Removed handling of UTF-8 BOM. Decorator Callbacks: Exceptions in policy change notifications are now logged. Mnesia to Khepri Migration: Migration throughput has been improved. : Added settings and configured the polling interval. : Fixed the crash issue when receiving zero-sized frames. : Fixed the crash issue when stream declaration fails. Request Body Size Limits: Request bodies exceeding the configured maximum limit are now rejected earlier. API Endpoint Validation: Validation for multiple API endpoints has been improved. Queue API Responses: Responses now include policy-related fields. CLI Tools: Fixed the crash issue in and when in maintenance mode. Federation Management Plugin: The and parameter values are now correctly escaped. Prometheus Plugin: The and metadata lines for Raft metrics are no longer generated repeatedly. Grafana Dashboard: The "TCP sockets available" panel has been replaced with the "File descriptors available" panel. Shovel Plugin: Fixed the exception issue when declaring a dynamic shovel. Web STOMP Plugin: Fixed the crash issue caused by the heartbeat monitoring process. Code Blocks No specific POC code or exploitation code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.2.5 Advisory: Multiple Component Crashes and Defect Fixes

More from this source