RabbitMQ 4.2.7 Security Update: Virtual Host Deletion Bug and Permission Control Fix

RabbitMQ 4.2.7 Security Update Summary Vulnerability Overview This update primarily fixes the following security-related vulnerabilities: 1. Virtual Host Deletion Error: Under specific conditions involving metadata storage errors and timeouts, virtual hosts may be erroneously treated as deleted. 2. Access Control Flaw: Previously, passive declarations for virtual hosts and exchanges were only allowed for users with privileges, revealing a flaw in the permission verification logic. 3. Garbage Collection Anomaly: During node shutdown, garbage collection (GC) for classic queue message storage failed to terminate cleanly. 4. Quorum Queue Dead Letter Routing Error: Fixed a bug where dead lettering in Quorum queues could mistakenly route commands to the wrong member (replica). Impact Scope Version: RabbitMQ 4.2.x series (versions prior to 4.2.7). Components: Core Server Stream Plugin Management Plugin MQTT Plugin Federation Plugin LDAP / HTTP Auth / Trust Store Plugins Remediation Upgrade Version: It is recommended to upgrade to RabbitMQ 4.2.7 or a later version. Configuration Changes: The configuration item has been renamed to (the old name is still supported as an alias). The configuration item has been renamed to (the old name is still supported as an alias). New configuration items such as , , and have been added to limit concurrent connections. New configuration items and have been added to configure TLS cipher suites. Dependency Updates: upgraded to 2.17.3 upgraded to 3.7.6 upgraded to 2.15.0 upgraded to 2.13.1 upgraded to 2.3.8 Related Issue Links Virtual Host Deletion Error: #16422 Access Control: #16272 Garbage Collection: #15498 Quorum Queue Dead Letter: #16203 Stream Protocol Handling: #16341 MQTT Connection Anomaly: #16391 Federation Restart Failure: #16234, #16224 Trust Store Configuration: #16201

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.2.7 Security Update: Virtual Host Deletion Bug and Permission Control Fix

More from this source