RabbitMQ 4.2.6 Security Advisory: Quorum Queue & Management UI Fixes

Vulnerability Overview Multiple vulnerabilities exist in RabbitMQ 4.2.6, primarily involving message queues, permission checks, and configuration management. Affected Scope Quorum queues: The command may return messages out of order. rabbitmqctl forget_cluster_node: All quorum queue and stream members (replicas) are removed before leaving the cluster, which may leave some replicas on the node that is leaving. AMQP 0-9-1 configure permission check: Now applies to passive queue and exchange declarations, matching the behavior of their regular counterparts. Khepri missing keys: Now correctly distinguishes errors in certain internal operations, avoiding unnecessary error-level log messages. Bindings targeting Direct Reply-to pseudo-queues: Now rejected, instead of being silently accepted with no functional effect. Management UI: OAuth 2 combined with basic_auth may fail to reload provider configurations correctly. Management UI: A 401 error occurs after a user changes their password; sessions are now automatically refreshed. Management UI: The endpoint has been removed. POST /api/users/bulk-delete: Now respects the configuration, matching the behavior of the single-user endpoint. Quorum queue status and stream tracking endpoints: Now enforce virtual host access checks, consistent with other vhost-scoped endpoints. HTTP API: Displays static connection information (peer address, TLS details, authentication mechanism), even when statistics collection is disabled. Super stream creation: Via HTTP API, now validates permissions, matching the stream protocol code path. Management API regex filters: Now enforces matching limits to prevent pathological patterns from consuming excessive CPU time. MQTT QoS 0 queue type: Member information is now reported in management API responses. WebSocket connections: A default is now set, limiting decompressed frame sizes. WebSocket connections: is now enforced, matching TCP listener behavior. WebSocket Origin header validation: Can now be configured via and . AMQP 1.0 shovels: No longer incorrectly detach links when closing connections, preventing spurious error log entries during closure. AMQP 1.0 shovel status: No longer includes the full connection URI in API responses and CLI output. DELETE operation: Now requires the tag, matching the corresponding federation plugin behavior. Federation link restart operation: Now requires the tag. Auth cache backend: Now correctly delegates token expiration timestamps to the wrapped backend, ensuring connections are closed when tokens expire. OAuth 2 Management UI: Improvements to provider configuration loading and rendering. DN values: Now handled according to RFC 4514. Certificate identification: Refactored to avoid (unlikely) conflicts. Certificate management: Introduces appropriate CLI commands. Rejected certificates: Logs additional diagnostic details. Binding weights: Binding weights exceeding 10,000 are now rejected; previously, extremely large weights could cause excessive memory allocation. Remediation Quorum queues: Ensure the command returns messages in the correct order. rabbitmqctl forget_cluster_node: Correctly remove all quorum queue and stream members (replicas) before leaving the cluster. AMQP 0-9-1 configure permission check: Ensure permission checks apply to passive queue and exchange declarations. Khepri missing keys: Correctly distinguish errors in certain internal operations to avoid unnecessary error-level log messages. Bindings targeting Direct Reply-to pseudo-queues: Reject bindings targeting Direct Reply-to pseudo-queues. Management UI: Ensure OAuth 2 combined with basic_auth correctly reloads provider configurations. Management UI: Automatically refresh sessions after a user changes their password. Management UI: Remove the endpoint. POST /api/users/bulk-delete: Respect the configuration. Quorum queue status and stream tracking endpoints: Enforce virtual host access checks. HTTP API: Display static connection information even when statistics collection is disabled. Super stream creation: Validate permissions. Management API regex filters: Enforce matching limits. MQTT QoS 0 queue type: Report member information in management API responses. WebSocket connections: Set a default , enforce , and support WebSocket Origin header validation. AMQP 1.0 shovels: Correctly detach links when closing connections. AMQP 1.0 shovel status: Do not include the full connection URI in API responses and CLI output. DELETE operation: Require the tag. Federation link restart operation: Require the tag. Auth cache backend: Correctly delegate token expiration timestamps to the wrapped backend. OAuth 2 Management UI: Improve provider configuration loading and rendering. DN values: Handle according to RFC 4514. Certificate identification: Refactor to avoid conflicts. Certificate management: Introduce appropriate CLI commands. Rejected certificates: Log additional diagnostic details. Binding weights: Reject binding weights exceeding 10,000. POC

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ 4.2.6 Security Advisory: Quorum Queue & Management UI Fixes

More from this source