RabbitMQ 4.3.5 Vulnerability Fixes and Security Hardening Advisory

Key Summary of RabbitMQ 4.3.5 Update Vulnerability Overview This update primarily addresses multiple security vulnerabilities and stability issues affecting the core server, Stream plugin, Management plugin, OAuth 2 plugin, Shovel plugin, Federation plugin, MQTT plugin, STOMP plugin, Web STOMP plugin, and Consistent Hash Exchange plugin. Scope of Impact Core Server: Message routing, queue recovery, cluster upgrades, AMQP 1.0 protocol handling, Topic exchange, connection credential refresh, HTTPS endpoints, Erlang client logging. Stream Plugin: Connection limits, authentication and authorization, frame size limits, uncompressed sub-entry batch size. Management Plugin: HTTP API endpoint validation, UI alert display, credential encryption, conditional requests, Referer-Policy, CORS headers, JSON definition import. OAuth 2 Plugin: Request header handling in proxy mode. Shovel Plugin: Log noise, static Shovel startup, topology configuration failures, HTTP API URL processing, TTL dynamic Shovel. Federation Plugin: Upstream URI parsing. MQTT Plugin: Network fragment parsing, attribute validation, receive maximum packet size. STOMP Plugin: Frame size limits. Web STOMP Plugin: Accumulated frame size check. Consistent Hash Exchange Plugin: Edge cases in bucket selection. Remediation Details Core Server: - Fixed an issue where messages sent to multiple targets could result in duplicate delivery. - Fixed an issue where internal state was partially initialized when a queue recovered from a recovery checkpoint. - Fixed an issue where local queue queries during cluster rolling upgrades fell back to older state machine versions. - Fixed an issue where malformed AMQP 1.0 frames caused exceptions rather than protocol-level errors. - Enhanced the AMQP 1.0 message parser with better validation of message segments and improved decoding efficiency for array types. - Limited the number of uses for multi-part wildcard binding keys in Topic exchanges. - Fixed an issue where user tags were not updated during connection credential refresh. - Fixed an issue where importing HTTPS endpoint definitions failed when TLS client certificates were password-protected. - Fixed an issue where the AMQP 1.0 Erlang client logged exceptions when a link was already detached. - Enhanced authentication event logging: successful logins are recorded at the level, while failed attempts are recorded at the level. Stream Plugin: - Limited Stream protocol connections to a maximum of 256 publishers and 256 subscribers. - Enforced a low limit on the server side before client connection authentication and authorization are completed. - Added the setting to limit the size of uncompressed sub-entry batches. Management Plugin: - Fixed an issue where the HTTP API endpoint accepted node names without verifying if the target node was a cluster member. - Fixed an issue where the Management UI no longer redundantly displayed certain alert messages. - When is configured, the Management UI login endpoint now returns client credentials encrypted with AES-256-GCM. - now supports conditional requests (ETag). - The HTTP response header can now be configured via . - When is set to , the HTTP response header is omitted from all responses except for responses. - When is set to , the Management UI and HTTP API reject definition uploads unless the file ends with the extension. OAuth 2 Plugin: - Fixed an issue where the OAuth 2 login flow now respects , , and headers when RabbitMQ acts as a TLS-terminating proxy. Shovel Plugin: - Reduced log noise. - Fixed an issue where static Shovel startup failed if no were defined. - When the topology configuration failure stops the Shovel worker process, it now reports the specific cause instead of a generic reason. - The Shovel HTTP API now processes Shovel URLs in the same manner as the Federation plugin. - Added support for the setting in Shovel TTL dynamic Shovels, indicating the Shovel should self-delete after at least the specified duration. Federation Plugin: - Fixed an issue where malformed upstream URIs could prevent Federation links from starting; the plugin now attempts all candidate URIs. MQTT Plugin: - More efficient parsing of packets spanning multiple network fragments. - Strictly rejects MQTT 5.0 attributes if they are invalid for the given packet type. - Rejects values of 0, in compliance with the MQTT 5.0 specification. STOMP Plugin: - Enforces frame size limits earlier in the connection lifecycle. Web STOMP Plugin: - After connection authentication, the accumulated frame size is now checked against , aligning with the behavior of "standard" STOMP connections. Consistent Hash Exchange Plugin: - Gracefully handles edge cases in bucket selection. Dependency Changes upgraded to upgraded to upgraded to upgraded to upgraded to Contributors michallovits sauravonvwm Pylar

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.3.5 Vulnerability Fixes and Security Hardening Advisory

More from this source