CVE-2014-9650: CRLF Injection
Published Jan 27, 2015
·Updated
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Affected Software
88 affected components
VMware RabbitMQ=2.1.0
VMware RabbitMQ=2.1.1
VMware RabbitMQ=2.2.0
VMware RabbitMQ=2.3.0
VMware RabbitMQ=2.3.1
VMware RabbitMQ=2.4.0
VMware RabbitMQ=2.4.1
VMware RabbitMQ=2.5.0
VMware RabbitMQ=2.5.1
VMware RabbitMQ=2.6.0
VMware RabbitMQ=2.6.1
VMware RabbitMQ=2.7.0
VMware RabbitMQ=2.7.1
VMware RabbitMQ=2.8.0
VMware RabbitMQ=2.8.1
VMware RabbitMQ=2.8.2
VMware RabbitMQ=2.8.3
VMware RabbitMQ=2.8.4
VMware RabbitMQ=2.8.5
VMware RabbitMQ=2.8.6
VMware RabbitMQ=2.8.7
VMware RabbitMQ=3.0.0
VMware RabbitMQ=3.0.1
VMware RabbitMQ=3.0.2
VMware RabbitMQ=3.0.3
VMware RabbitMQ=3.0.4
VMware RabbitMQ=3.1.0
VMware RabbitMQ=3.1.1
VMware RabbitMQ=3.1.2
VMware RabbitMQ=3.1.3
VMware RabbitMQ=3.1.4
VMware RabbitMQ=3.1.5
VMware RabbitMQ=3.2.0
VMware RabbitMQ=3.2.1
VMware RabbitMQ=3.2.2
VMware RabbitMQ=3.2.3
VMware RabbitMQ=3.2.4
VMware RabbitMQ=3.3.0
VMware RabbitMQ=3.3.1
VMware RabbitMQ=3.3.2
VMware RabbitMQ=3.3.3
VMware RabbitMQ=3.3.4
VMware RabbitMQ=3.3.5
VMware RabbitMQ=3.4.0
Broadcom Rabbitmq Server=2.1.0
Broadcom Rabbitmq Server=2.1.1
Broadcom Rabbitmq Server=2.2.0
Broadcom Rabbitmq Server=2.3.0
Broadcom Rabbitmq Server=2.3.1
Broadcom Rabbitmq Server=2.4.0
Broadcom Rabbitmq Server=2.4.1
Broadcom Rabbitmq Server=2.5.0
Broadcom Rabbitmq Server=2.5.1
Broadcom Rabbitmq Server=2.6.0
Broadcom Rabbitmq Server=2.6.1
Broadcom Rabbitmq Server=2.7.0
Broadcom Rabbitmq Server=2.7.1
Broadcom Rabbitmq Server=2.8.0
Broadcom Rabbitmq Server=2.8.1
Broadcom Rabbitmq Server=2.8.2
Broadcom Rabbitmq Server=2.8.3
Broadcom Rabbitmq Server=2.8.4
Broadcom Rabbitmq Server=2.8.5
Broadcom Rabbitmq Server=2.8.6
Broadcom Rabbitmq Server=2.8.7
Broadcom Rabbitmq Server=3.0.0
Broadcom Rabbitmq Server=3.0.1
Broadcom Rabbitmq Server=3.0.2
Broadcom Rabbitmq Server=3.0.3
Broadcom Rabbitmq Server=3.0.4
Broadcom Rabbitmq Server=3.1.0
Broadcom Rabbitmq Server=3.1.1
Broadcom Rabbitmq Server=3.1.2
Broadcom Rabbitmq Server=3.1.3
Broadcom Rabbitmq Server=3.1.4
Broadcom Rabbitmq Server=3.1.5
Broadcom Rabbitmq Server=3.2.0
Broadcom Rabbitmq Server=3.2.1
Broadcom Rabbitmq Server=3.2.2
Broadcom Rabbitmq Server=3.2.3
Broadcom Rabbitmq Server=3.2.4
Broadcom Rabbitmq Server=3.3.0
Broadcom Rabbitmq Server=3.3.1
Broadcom Rabbitmq Server=3.3.2
Broadcom Rabbitmq Server=3.3.3
Broadcom Rabbitmq Server=3.3.4
Broadcom Rabbitmq Server=3.3.5
Broadcom Rabbitmq Server=3.4.0
Event History
Jan 27, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9650?
CVE-2014-9650 has been assigned a medium severity rating due to its potential for HTTP response splitting attacks.
2
How do I fix CVE-2014-9650?
To fix CVE-2014-9650, upgrade RabbitMQ to version 3.4.1 or later.
3
What versions are affected by CVE-2014-9650?
CVE-2014-9650 affects RabbitMQ versions from 2.1.0 to 3.4.0.
4
Can CVE-2014-9650 be exploited remotely?
Yes, CVE-2014-9650 can be exploited remotely due to its nature of accepting malicious input parameters.
5
What type of attacks can CVE-2014-9650 enable?
CVE-2014-9650 can enable attacks such as HTTP response splitting and arbitrary HTTP header injection.