CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
97.4%
Debian LTS Advisory DLA-2710-1 [email protected]
https://www.debian.org/lts/security/ Abhijith PA
July 19, 2021 https://wiki.debian.org/LTS
Package : rabbitmq-server
Version : 3.6.6-1+deb9u1
CVE ID : CVE-2017-4965 CVE-2017-4966 CVE-2017-4967 CVE-2019-11281
CVE-2019-11287 CVE-2021-22116
Several vulnerabilities were discovered in rabbitmq-server, a
message-broker software.
CVE-2017-4965
Several forms in the RabbitMQ management UI are vulnerable to XSS
attacks.
CVE-2017-4966
RabbitMQ management UI stores signed-in user credentials in a
browser's local storage without expiration, making it possible to
retrieve them using a chained attack
CVE-2017-4967
Several forms in the RabbitMQ management UI are vulnerable to XSS
attacks.
CVE-2019-11281
The virtual host limits page, and the federation management UI,
which do not properly sanitize user input. A remote authenticated
malicious user with administrative access could craft a cross site
scripting attack that would gain access to virtual hosts and
policy management information
CVE-2019-11287
The "X-Reason" HTTP Header can be leveraged to insert a malicious
Erlang format string that will expand and consume the heap,
resulting in the server crashing.
CVE-2021-22116
A malicious user can exploit the vulnerability by sending
malicious AMQP messages to the target RabbitMQ instance.
For Debian 9 stretch, these problems have been fixed in version
3.6.6-1+deb9u1.
We recommend that you upgrade your rabbitmq-server packages.
For the detailed security status of rabbitmq-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rabbitmq-server
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | all | rabbitmq-server | < 3.6.6-1+deb9u1 | rabbitmq-server_3.6.6-1+deb9u1_all.deb |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
97.4%