Input validation error in RabbitMQ - CVE-2019-11287

Vulnerability identifier: #VU24218

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11287

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via the "X-Reason" HTTP Header. A remote attacker can inject a malicious Erlang format string into the "X-Reason" HTTP Header that once expanded will consume the heap, resulting in the server crashing.

RabbitMQ
Red Hat OpenStack for IBM Power
Red Hat OpenStack
Communications Unified Assurance
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Ubuntu
Fedora
openstack-heat-templates
python-Django1
python-Django
ruby2.1-rubygem-puma-debuginfo
rubygem-puma-debugsource
ruby2.1-rubygem-puma
rabbitmq-server (Ubuntu package)
rabbitmq-server-plugins
rabbitmq-server
python-murano
openstack-murano
openstack-murano-api
openstack-murano-doc
openstack-murano-engine
venv-openstack-murano-x86_64
grafana
grafana-debuginfo
ardana-cobbler
ardana-ansible
ardana-tempest
venv-openstack-heat-x86_64
venv-openstack-horizon-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-neutron-x86_64
python-horizon-plugin-gbp-ui
openstack-horizon-plugin-gbp-ui
openstack-neutron-gbp
python-neutron-gbp
venv-openstack-nova-x86_64
python-nova
openstack-nova-vncproxy
openstack-nova-serialproxy
openstack-nova-scheduler
openstack-nova-placement-api
openstack-nova-novncproxy
openstack-nova-console
openstack-nova-conductor
openstack-nova-compute
openstack-nova-cells
openstack-nova-api
openstack-nova

Install updates from vendor's website.

RabbitMQ - addressed in versions 3.7.21, 3.8.1
openstack-heat-templates - addressed in versions 0.0.0+git.1654529662.75fa04a-3.27.1, 0.0.0+git.1654529662.75fa04a7-3.15.1
python-Django1 - update to 1.11.29-3.40.1
python-Django - update to 1.11.29-3.42.1
ruby2.1-rubygem-puma-debuginfo - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
rubygem-puma-debugsource - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
ruby2.1-rubygem-puma - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
rabbitmq-server (Ubuntu package) - addressed in versions 3.6.10-1ubuntu0.5, 3.8.2-0ubuntu1.3, 3.8.5-1ubuntu0.2, 3.8.9-2ubuntu0.1
rabbitmq-server-plugins - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
rabbitmq-server - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
rabbitmq-server - addressed in versions 3.7.22-1.fc30, 3.7.22-1.fc31
python-murano - update to 4.0.2~dev3-3.12.1
openstack-murano - update to 4.0.2~dev3-3.12.1
openstack-murano-api - update to 4.0.2~dev3-3.12.1
openstack-murano-doc - update to 4.0.2~dev3-3.12.1
openstack-murano-engine - update to 4.0.2~dev3-3.12.1
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.38.1
grafana - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1
grafana-debuginfo - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1
ardana-cobbler - addressed in versions 8.0+git.1660773402.d845a45-3.47.1, 9.0+git.1660747489.119efcd-3.19.1
ardana-ansible - addressed in versions 8.0+git.1660773729.3789a6d-3.85.1, 9.0+git.1660748476.c118d23-3.32.1
ardana-tempest - update to 9.0+git.1651855288.a2341ad-3.22.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.45.1, 11.0.4~dev4-3.37.1
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.48.1, 14.1.1~dev11-4.41.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.48.1
venv-openstack-neutron-x86_64 - update to 13.0.8~dev206-6.41.1
python-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
openstack-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
openstack-neutron-gbp - update to 14.0.1~dev46-3.34.1
python-neutron-gbp - update to 14.0.1~dev46-3.34.1
venv-openstack-nova-x86_64 - update to 18.3.1~dev92-3.41.1
python-nova - update to 18.3.1~dev92-3.43.1
openstack-nova-vncproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-serialproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-scheduler - update to 18.3.1~dev92-3.43.1
openstack-nova-placement-api - update to 18.3.1~dev92-3.43.1
openstack-nova-novncproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-console - update to 18.3.1~dev92-3.43.1
openstack-nova-conductor - update to 18.3.1~dev92-3.43.1
openstack-nova-compute - update to 18.3.1~dev92-3.43.1
openstack-nova-cells - update to 18.3.1~dev92-3.43.1
openstack-nova-api - update to 18.3.1~dev92-3.43.1
openstack-nova - update to 18.3.1~dev92-3.43.1

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/
• https://pivotal.io/security/cve-2019-11287

• Multiple vulnerabilities in Pivotal RabbitMQ
• Red Hat update for rabbitmq-server
• Ubuntu update for rabbitmq-server
• SUSE update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma
• SUSE update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma
• Multiple vulnerabilities in Communications Unified Assurance
• Fedora 31 update for rabbitmq-server
• Fedora 30 update for rabbitmq-server