RabbitMQ 4.2.9 Release Notes: Security Vulnerabilities Fixes and Hardening

Key Highlights of RabbitMQ Version 4.2.9 Release Vulnerability Overview This update primarily addresses multiple security vulnerabilities and stability issues across core components, including the core server, CLI tools, Stream plugin, Management plugin, and authentication plugins. Impact Scope Core Server Queue Index Path Issue: The directory path for classic queue indexes may accumulate slashes, potentially leading to filesystem errors. AMQP 1.0 Authority Verification: When declaring a exchange with a dead letter exchange, necessary permissions for the dead letter exchange are now validated. AMQP 1.0 Consistency: The operation is now consistent with the behavior of binding-related handlers. Worker Pool Processes: No longer terminate upon receiving unexpected messages. Race Condition: A race condition between concurrent queue (or virtual host) deletion and Ra cluster shutdown could cause exceptions. Channel Close: Closing a channel (connection) by sending on an already terminated writer or socket no longer generates log noise. Channel Termination Cleanup: No longer generates log noise. Error Handling: Code paths using now handle more errors. Node Startup: Nodes may fail to start with a exception if, in the metadata store, quorum queue records have their decorators set to . Tracing Feature: Enabling tracing across multiple virtual hosts may silently drop traces for some virtual hosts. CLI Tools The command now tolerates plugins listed as enabled but not installed. no longer outputs an empty plugin table when the target node is unreachable. The command now correctly validates plugin file paths on remote nodes, eliminating false positives for in offline mode. Shell (Bash, zsh) command completion has been fixed. Stream Plugin Permissions required for certain stream protocol operations have been adjusted to align with comparable operations in other protocols. Management Plugin OAuth 2 Login: May fail in Safari; a new token endpoint proxy is now used for affected authorization flows. UI Templates: Secure string escaping is now used in more places. HTTP API: The message publishing endpoint now uses a timeout while waiting for publisher acknowledgments. OAuth 2 AuthN and AuthZ Backend Plugin The (token expiration) timestamp value in the payload is now correctly enforced. The token refresh path is now more robust. Shovel Plugin Fixed multiple shovel bugs, including the potential leakage of credentials in static shovel URLs. Shovels deleted before successful connection (while in the state) no longer leak their status entries. Federation Plugin Federation upstream URLs are now subject to stricter validation. MQTT Plugin Peer detection is more accurate in settings where the proxy protocol is enabled. Web MQTT Plugin Peer detection is more accurate in settings where the proxy protocol is enabled. The response header policy can now be configured for the Web MQTT listener. STOMP Plugin Internal socket handling has been refactored and shared between STOMP and Web STOMP connections. Web STOMP Plugin Peer detection is more accurate in settings where the proxy protocol is enabled. The response header policy can now be configured for the Web STOMP listener. LDAP AuthN and AuthZ Backend Plugin Improved additional DN escaping (RFC 4514). JMS Topic Exchange Plugin JMS selector evaluation now uses smaller, safer limits. AWS Peer Discovery Plugin Fixed SigV4 request signing issues ( ) for requests without a body, such as . Remediation Measures Core Server Enhancements Password salts are now generated using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). Socket-level metric collection can now concurrently handle closed connections. CLI Tool Enhancements and now provide the command for individual queues and streams. Security improvements for : The command now handles certain failures more gracefully. Stream Plugin Enhancements The maximum number of super stream partitions is now defaulted to 1,000 (can be increased via the key in ). Client RPC timeouts are now logged as concise messages rather than exceptions with stack traces. Management Plugin Enhancements Exporting via the HTTP API is now significantly more efficient, using HTTP response streaming for results. The HTTP response header is now set (configurable). HTTP API error responses have been refactored to be more consistent and expose fewer internal details. Dependency Changes upgraded to . Important Notes Minimum Supported Erlang Version: Starting with this version, the minimum supported Erlang version is . Erlang/OTP has reached end-of-life and is no longer supported. Compatibility: Nodes will not start on older Erlang versions. POC/Exploit Code No POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.2.9 Release Notes: Security Vulnerabilities Fixes and Hardening

More from this source