CVE-2014-9650

2015-01-2720:03:15

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.004

Percentile

73.7%

JSON

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.

OSVersionArchitecturePackageVersionFilename
Debian12allrabbitmq-server< 3.4.1-1rabbitmq-server_3.4.1-1_all.deb
Debian11allrabbitmq-server< 3.4.1-1rabbitmq-server_3.4.1-1_all.deb
Debian999allrabbitmq-server< 3.4.1-1rabbitmq-server_3.4.1-1_all.deb
Debian13allrabbitmq-server< 3.4.1-1rabbitmq-server_3.4.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	rabbitmq-server	< 3.4.1-1	rabbitmq-server_3.4.1-1_all.deb
Debian	11	all	rabbitmq-server	< 3.4.1-1	rabbitmq-server_3.4.1-1_all.deb
Debian	999	all	rabbitmq-server	< 3.4.1-1	rabbitmq-server_3.4.1-1_all.deb
Debian	13	all	rabbitmq-server	< 3.4.1-1	rabbitmq-server_3.4.1-1_all.deb