Resource exhaustion in RabbitMQ Java Client Library - CVE-2023-46120

Vulnerability identifier: #VU83414

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46120

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. A remote attacker can send a very large Message causing a memory overflow and triggering an OOM Error to perform a denial of service (DoS) attack.

RabbitMQ Java Client Library
Cognos Dashboards on Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
Storage Copy Data Management
Cloud Pak for Network Automation
IBM Watson Discovery for IBM Cloud Pak for Data
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Qradar SIEM
watsonx.data
Operational Decision Manager

Install updates from vendor's website.

RabbitMQ Java Client Library - update to 5.18.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.0
Netcool Operations Insight - update to 1.6.12
watsonx.data - update to 2.0.3
Storage Copy Data Management - update to 2.2.24.0
Cloud Pak for Network Automation - update to 2.6.4
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.2
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 47, 8.11.0.1 Interim fix 25, 8.11.1 Interim fix 15, 8.12.0 Interim fix 6

• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
• https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
• https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
• https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8

• Multiple vulnerabilities in IBM Operational Decision Manager
• IBM Watson Discovery Cartridge for IBM Cloud Pak for Data update for RabbitMQ Java Client
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Netcool Operations Insight
• Resource exhaustion in IBM QRadar SIEM RabbitMQ protocol
• Multiple vulnerabilities in IBM Storage Copy Data Management
• IBM watsonx.data update for RabbitMQ Java Client