RabbitMQ 4.3.3 Security Update: Fixes for Permission Validation and Credential Handling Vulnerabilities

RabbitMQ 4.3.3 Security Update Summary Vulnerability Overview RabbitMQ 4.3.3 is a maintenance release that primarily addresses multiple security vulnerabilities and stability issues. Scope of Impact Core Server: Components involving queue management, authentication/authorization, and message processing. CLI Tools: Plugin management commands. Stream Plugin: Stream protocol operation permissions. Management Plugin: OAuth 2 login, HTTP API responses. Shovel Plugin: Static Shovel URI credential handling. Federation Plugin: Upstream URI validation. MQTT Plugin: PROXY protocol host detection. Web MQTT Plugin: PROXY protocol host detection, HSTS response headers. Web STOMP Plugin: PROXY protocol host detection, HSTS response headers. LDAP AuthN and AuthZ Backend Plugins: DN escaping. JMS Topic Exchange Plugin: Selector validation. AWS Peer Discovery Plugin: SigV4 request signing. Remediation Core Server Bug Fixes: - Fixed an issue where Quorum Queues, Khepri, and other Raft leaders could incorrectly submit new log entries in certain scenarios. - Fixed an issue where Quorum Queues using the dead letter strategy could hang after repeated queue member changes. - Fixed an issue where classic queue index directory paths could accumulate slashes, eventually leading to an file system error. - Fixed an issue where enabling the configuration flag could fail in certain exchange topologies. - Fixed an issue where invalid values were being used instead of falling back to the default value (24 hours). - Fixed an issue where AMQP 1.0 management operations declaring exchanges with alternative exchanges now validate necessary permissions on those alternative exchanges. - Fixed an issue where the AMQP 1.0 management operation now behaves consistently with binding-related handlers. - Fixed an issue where worker pool processes no longer terminate upon receiving unexpected messages. - Fixed a race condition between concurrent queue (or virtual host) deletion and Raft cluster closure. - Fixed an issue where failures to send on terminated writers or sockets during channel closure no longer generate log noise. - Fixed an issue where unexpected failures during channel termination cleanup no longer generate log noise. - Fixed code paths using to handle more error cases. - Fixed an issue where nodes could fail to start due to exceptions. - Fixed an issue where concurrent trace enabling across multiple virtual hosts could silently drop some trace center virtual host issues. Enhancements: - Password salts are now generated using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). - Socket-level metric collection by multiple protocol readers and the management proxy can now close connections concurrently without restriction. CLI Tools Bug Fixes: - The command now tolerates plugins listed as enabled but not installed. - no longer outputs an empty plugin table when the target node is unreachable. - The command now correctly handles plugin paths on remote nodes, validates remote nodes in offline mode, and no longer reports false positives for . - Shell (Bash, zsh) command completion fixed. Enhancements: - and now provide a command for individual queues and streams. - Improved security for : the command now handles certain failures more gracefully. Stream Plugin Bug Fixes: - Permissions required for certain stream protocol operations have been adjusted to be consistent with comparable operations in other protocols. Enhancements: - The maximum number of Super Stream partitions is now limited to 1,000 by default; this limit can be increased via the key in . - Client RPC timeouts are now logged as concise messages rather than exceptions with stack traces. Management Plugin Bug Fixes: - Fixed an issue where OAuth 2 login might fail in Safari; a new token endpoint proxy is used for the affected authorization flows. - Multiple management UI templates now use safe string escaping in more places. - The HTTP API message publishing endpoint now uses a timeout while waiting for publisher acknowledgments. Enhancements: - Definition exports via the HTTP API are now significantly more efficient, using HTTP response streaming to deliver results. - The HTTP response header is now configurable. - The HTTP response header can now be excluded from HTTP API responses. - HTTP API error responses have been refactored to provide more consistency and expose fewer internal details. - HTTP access log entries for OAuth 2 authentication requests now use the username determined by the authentication backend (e.g., ) instead of the client ID. - Definition file uploads via the management UI now require the file extension (enabled via a feature flag). OAuth 2 AuthN and AuthZ Backend Plugins Bug Fixes: - Fractional (token expiration) timestamp values are now respected. Enhancements: - The token refresh path is now more robust. Shovel Plugin Bug Fixes: - Multiple Shovel error fixes, including an issue where credentials for static Shovel URIs could be leaked. - Sho

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.3.3 Security Update: Fixes for Permission Validation and Credential Handling Vulnerabilities

More from this source