RabbitMQ 4.3.2 Security Update: Fixes CORS Hardening and Password Storage Vulnerabilities

RabbitMQ 4.3.2 Security Update Summary Vulnerability Overview RabbitMQ 4.3.2 is a maintenance release that primarily fixes multiple security vulnerabilities and bugs, and includes several feature enhancements. Affected Components Core Server: Involves queue consumer state updates, queue declaration parameter validation, feature flag synchronization, and deprecated feature handling. CLI Tools: Involves missing validation during permission setting and virtual host addition. Stream Plugin: Involves performance regression in the stream protocol reader. Management Plugin: Involves CORS security hardening, file upload/download security, and HTTP response header handling. Prometheus Plugin: Involves support for encrypted values in configuration keys. MQTT Plugin: Involves configuration translation issues. Remediation Core Server Fixed an issue where the feature flag might fail in rare cases. Fixed an issue where passwords were not stored correctly when creating users without a password or with a password hash via the HTTP API (related to X.509 certificate authentication). Fixed an issue where the active state of classic queue consumers was not correctly updated or reported when was enabled. Fixed an issue where the optional parameters and were not validated during queue declaration. Fixed an issue where default queue type (DQT) validation treated empty strings as missing values. Optimized feature flag operations to avoid unnecessary synchronization for already enabled flags. Fixed an issue where configuration changes for deprecated features were not applied correctly. CLI Tools now validates the existence of the target user and exchange. now validates the provided default queue type value. Stream Plugin Fixed a performance regression in frame assembly within the stream protocol reader. Management Plugin CORS Hardening: The value is now validated; wildcard and header values are rejected. File Upload/Download Security: Definition imports now limit the size of the multipart upload body, and download filenames for definition exports are restricted to a safe character set. HTTP Response Security: HTTP API 500 responses no longer contain internal error details; multiple HTTP response headers now consistently use lowercase, and missing headers have been added. Security Warnings: A one-time warning is now logged when HSTS or CSP headers are disabled. Prometheus Plugin More plugin configuration keys (such as ) now support encrypted values in . MQTT Plugin Fixed an issue where settings did not take effect due to configuration translation problems. Dependency Changes upgraded to 3.0.1 upgraded to 2.18.0 upgraded to 2.17.0 upgraded to 2.4.0 POC/Exploit Code No POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.3.2 Security Update: Fixes CORS Hardening and Password Storage Vulnerabilities

More from this source