{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-46118", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-16T17:51:35.571Z", "datePublished": "2023-10-24T23:27:06.952Z", "dateUpdated": "2025-02-13T17:14:16.640Z"}, "containers": {"cna": {"title": "Denial of Service by publishing large messages over the HTTP API", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"}, {"url": "https://www.debian.org/security/2023/dsa-5571"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": "< 3.12.7", "status": "affected"}, {"version": "< 3.11.24", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-14T00:06:21.527Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7."}], "source": {"advisory": "GHSA-w6cq-9cf4-gqpg", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:37:39.445Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"}, {"url": "https://www.debian.org/security/2023/dsa-5571", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A9EFC4A-CB21-496D-B5B6-FF067DFDA296", "versionEndExcluding": "3.11.24", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*", "matchCriteriaId": "A33FAAC4-F41B-4075-89EF-5DAC62E2F3BF", "versionEndExcluding": "3.12.7", "versionStartIncluding": "3.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7."}, {"lang": "es", "value": "RabbitMQ es un corredor de transmisi\u00f3n y mensajer\u00eda multiprotocolo. La API HTTP no aplicaba un l\u00edmite de cuerpo de solicitud HTTP, lo que la hac\u00eda vulnerable a ataques de denegaci\u00f3n de servicio (DoS) con mensajes muy grandes. Un usuario autenticado con credenciales suficientes puede publicar mensajes muy grandes a trav\u00e9s de la API HTTP y hacer que el nodo de destino finalice mediante un mecanismo similar al \"eliminador de memoria insuficiente\". Esta vulnerabilidad ha sido parcheada en las versiones 3.11.24 y 3.12.7."}], "id": "CVE-2023-46118", "lastModified": "2024-11-21T08:27:54.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-25T18:17:36.117", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"}, {"source": "security-advisories@github.com", "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html"}, {"source": "security-advisories@github.com", "url": "https://www.debian.org/security/2023/dsa-5571"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2023/dsa-5571"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:0217", "cpe": "cpe:/a:redhat:openstack:17.1::el9", "package": "rabbitmq-server-0:3.9.10-3.el9ost", "product_name": "Red Hat OpenStack Platform 17.1 for RHEL 9", "release_date": "2024-01-16T00:00:00Z"}], "bugzilla": {"description": "rabbitmq-server: DoS by publishing large messages over the HTTP API", "id": "2246512", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246512"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.", "A flaw was found in the rabbitmq-server. An authenticated user with sufficient credentials can publish very large messages over the HTTP API and cause the target node to be terminated by an \"out-of-memory killer\" like mechanism."], "name": "CVE-2023-46118", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.1", "fix_state": "Will not fix", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.1"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Will not fix", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2023-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-46118\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-46118\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"], "threat_severity": "Moderate", "upstream_fix": "rabbitmq-server 3.12.7, rabbitmq-server 3.11.24"}