Input validation error in RabbitMQ - CVE-2021-22116

Vulnerability identifier: #VU53724

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22116

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing AMPQ messages in AMQP 1.0 client connection endpoint.. A remote attacker can send specially crafted input to the application and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that AMQP 1.0 plugin is enabled.

RabbitMQ
Arch Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Module for Server Applications
Server Applications Module
openSUSE Leap
Ubuntu
elixir115-doc
elixir115
rabbitmq-server (Ubuntu package)
rabbitmq-server
rabbitmq-server-plugins
erlang-rabbitmq-client
rabbitmq-server313-zsh-completion
rabbitmq-server313-bash-completion
rabbitmq-server313
erlang-rabbitmq-client313
rabbitmq-server313-plugins
erlang26-observer-src
erlang26-debugger
erlang26-dialyzer-debuginfo
erlang26-diameter
erlang26-epmd
erlang26-jinterface-src
erlang26-wx-debuginfo
erlang26-dialyzer
erlang26
erlang26-wx
erlang26-doc
erlang26-dialyzer-src
erlang26-wx-src
erlang26-reltool-src
erlang26-debugsource
erlang26-debugger-src
erlang26-src
erlang26-diameter-src
erlang26-observer
erlang26-epmd-debuginfo
erlang26-jinterface
erlang26-et
erlang26-reltool
erlang26-debuginfo
erlang26-et-src

Install updates from vendor's website.

RabbitMQ - update to 3.8.16
elixir115-doc - update to 1.15.7-150300.7.5.1
elixir115 - update to 1.15.7-150300.7.5.1
rabbitmq-server (Ubuntu package) - addressed in versions 3.6.10-1ubuntu0.5, 3.8.2-0ubuntu1.3, 3.8.5-1ubuntu0.2, 3.8.9-2ubuntu0.1
rabbitmq-server - update to 3.8.3-3.3.4
rabbitmq-server-plugins - update to 3.8.3-3.3.4
erlang-rabbitmq-client - update to 3.8.3-3.3.4
rabbitmq-server313-zsh-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313-bash-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313 - update to 3.13.1-150600.13.5.3
erlang-rabbitmq-client313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-plugins - update to 3.13.1-150600.13.5.3
erlang26-observer-src - update to 26.2.1-150300.7.5.1
erlang26-debugger - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-diameter - update to 26.2.1-150300.7.5.1
erlang26-epmd - update to 26.2.1-150300.7.5.1
erlang26-jinterface-src - update to 26.2.1-150300.7.5.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-dialyzer - update to 26.2.1-150300.7.5.1
erlang26 - update to 26.2.1-150300.7.5.1
erlang26-wx - update to 26.2.1-150300.7.5.1
erlang26-doc - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.5.1
erlang26-wx-src - update to 26.2.1-150300.7.5.1
erlang26-reltool-src - update to 26.2.1-150300.7.5.1
erlang26-debugsource - update to 26.2.1-150300.7.5.1
erlang26-debugger-src - update to 26.2.1-150300.7.5.1
erlang26-src - update to 26.2.1-150300.7.5.1
erlang26-diameter-src - update to 26.2.1-150300.7.5.1
erlang26-observer - update to 26.2.1-150300.7.5.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-jinterface - update to 26.2.1-150300.7.5.1
erlang26-et - update to 26.2.1-150300.7.5.1
erlang26-reltool - update to 26.2.1-150300.7.5.1
erlang26-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-et-src - update to 26.2.1-150300.7.5.1

• https://tanzu.vmware.com/security/cve-2021-22116

• Denial of service in Pivotal RabbitMQ
• Arch Linux update for rabbitmq
• SUSE Linux Enterprise Module for Server Applications update for rabbitmq-server
• SUSE update for rabbitmq-server
• Ubuntu update for rabbitmq-server
• SUSE update for Feature update for rabbitmq-server313, erlang26, elixir115