RabbitMQ 4.2.8 Security Update: Auth Leakage, CORS, Path Traversal Fixes

RabbitMQ 4.2.8 Security Update Summary Vulnerability Overview This update includes multiple security fixes, primarily addressing vulnerabilities in authentication mechanisms, access control, and input validation. Affected Scope Core Server: HTTP API authentication, queue consumer state management Management Plugin: CORS policy, file upload/download, HTTP response handling CLI Tools: Queue type validation Remediation 1. Authentication Information Leakage Fix (Core Server) Issue: Users created via the HTTP API (such as those relying on X.509 certificate authentication) did not have their passwords or password hashes stored correctly. This caused sensitive information to be potentially exposed when the user password was cleared using the command. Fix: Authentication information is now stored correctly to prevent password leakage. Related Issue: #16629, #16633 2. CORS Security Hardening (Management Plugin) Issue: The value was not validated, and wildcard ( ) header values were accepted, potentially allowing cross-site request forgery attacks. Fix: The value is now validated, and wildcard header values are rejected. Related Issue: #16544 3. File Upload/Download Security Restrictions (Management Plugin) Issue: Definition imports did not restrict the size of the multipart upload body, and the download filenames for definition exports were not restricted to a safe character set. This could potentially allow path traversal or large file upload attacks. Fix: The multipart upload body size is now restricted, and download filenames are limited to a safe character set. Related Issue: #16544 4. Error Information Leakage Fix (Management Plugin) Issue: HTTP API 500 responses contained internal error details, which could leak sensitive system information. Fix: Internal error details are no longer included in the response body. Related Issue: #16544 5. Queue Type Validation Fix (CLI Tools) Issue: The command did not validate the provided default queue type value. Fix: Validation for the default queue type value has been added. Related Issue: #16481 6. Other Security Enhancements HSTS/CSP Warning: A one-time warning is logged when HSTS or CSP headers are disabled (Issue: #16544) HTTP Response Header Normalization: Response headers are now consistently lowercase, and the missing header has been added (Issue: #16544) Dependency Updates upgraded to 1.9.1 upgraded to 2.16.0 upgraded to 2.17.0 upgraded to 2.3.0 Important Notes Erlang Version Requirement: Older Erlang releases are no longer supported; nodes will fail to start. Please check the RabbitMQ and Erlang/OTP Compatibility Matrix to confirm version requirements. Upgrade Recommendation: When upgrading from versions prior to 4.2.0, it is strongly recommended to read the 4.2.0 Release Notes.

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.2.8 Security Update: Auth Leakage, CORS, Path Traversal Fixes

More from this source