Resource exhaustion in RabbitMQ Server - CVE-2023-46118

Vulnerability identifier: #VU82551

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46118

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the HTTP API. A remote administrator can trigger resource exhaustion and perform a denial of service (DoS) attack.

RabbitMQ Server
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Server Applications Module
openSUSE Leap
Ubuntu
Orion Platform
elixir115-doc
elixir115
rabbitmq-server (Ubuntu package)
rabbitmq-server (Debian package)
rabbitmq-server
erlang-rabbitmq-client
rabbitmq-server-plugins
rabbitmq-server313
rabbitmq-server313-plugins
erlang-rabbitmq-client313
rabbitmq-server313-bash-completion
rabbitmq-server313-zsh-completion
erlang26-jinterface
erlang26-wx-debuginfo
erlang26-dialyzer
erlang26
erlang26-wx
erlang26-doc
erlang26-dialyzer-src
erlang26-wx-src
erlang26-observer-src
erlang26-debugsource
erlang26-debugger-src
erlang26-src
erlang26-diameter-src
erlang26-observer
erlang26-epmd-debuginfo
erlang26-et
erlang26-reltool
erlang26-debuginfo
erlang26-et-src
erlang26-reltool-src
erlang26-jinterface-src
erlang26-epmd
erlang26-diameter
erlang26-dialyzer-debuginfo
erlang26-debugger

Install updates from vendor's website.

RabbitMQ Server - addressed in versions 3.11.24, 3.12.7
Orion Platform - update to 2024.4
elixir115-doc - update to 1.15.7-150300.7.5.1
elixir115 - update to 1.15.7-150300.7.5.1
rabbitmq-server (Ubuntu package) - addressed in versions 3.8.2-0ubuntu1.5, 3.9.13-1ubuntu0.22.04.2, 3.10.8-1.1ubuntu0.1, 3.12.1-1ubuntu0.1
rabbitmq-server (Debian package) - addressed in versions 3.8.9-3+deb11u1, 3.10.8-1.1+deb12u1
rabbitmq-server - update to 3.8.11-150300.3.14.1
erlang-rabbitmq-client - update to 3.8.11-150300.3.14.1
rabbitmq-server-plugins - update to 3.8.11-150300.3.14.1
rabbitmq-server313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-plugins - update to 3.13.1-150600.13.5.3
erlang-rabbitmq-client313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-bash-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313-zsh-completion - update to 3.13.1-150600.13.5.3
erlang26-jinterface - update to 26.2.1-150300.7.5.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-dialyzer - update to 26.2.1-150300.7.5.1
erlang26 - update to 26.2.1-150300.7.5.1
erlang26-wx - update to 26.2.1-150300.7.5.1
erlang26-doc - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.5.1
erlang26-wx-src - update to 26.2.1-150300.7.5.1
erlang26-observer-src - update to 26.2.1-150300.7.5.1
erlang26-debugsource - update to 26.2.1-150300.7.5.1
erlang26-debugger-src - update to 26.2.1-150300.7.5.1
erlang26-src - update to 26.2.1-150300.7.5.1
erlang26-diameter-src - update to 26.2.1-150300.7.5.1
erlang26-observer - update to 26.2.1-150300.7.5.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-et - update to 26.2.1-150300.7.5.1
erlang26-reltool - update to 26.2.1-150300.7.5.1
erlang26-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-et-src - update to 26.2.1-150300.7.5.1
erlang26-reltool-src - update to 26.2.1-150300.7.5.1
erlang26-jinterface-src - update to 26.2.1-150300.7.5.1
erlang26-epmd - update to 26.2.1-150300.7.5.1
erlang26-diameter - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-debugger - update to 26.2.1-150300.7.5.1

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg

• Denial of service in RabbitMQ Server
• Ubuntu update for rabbitmq-server
• Debian update for rabbitmq-server
• SUSE update for rabbitmq-server
• SUSE update for Feature update for rabbitmq-server313, erlang26, elixir115
• Multiple vulnerabilities in SolarWinds Orion Platform