CVE-2019-11287
First published: Sat Nov 23 2019(Updated: )
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Credit: security@pivotal.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rabbitmq-server | <3.7.21 | 3.7.21 |
| redhat/rabbitmq-server | <3.8.1 | 3.8.1 |
| Pivotal Software Rabbitmq | >=1.16.0<1.16.7 | |
| Pivotal Software Rabbitmq | >=1.17.0<1.17.4 | |
| Pivotal Software Rabbitmq | >=3.7.0<3.7.21 | |
| Vmware Rabbitmq | >=3.8.0<3.8.1 | |
| Fedoraproject Fedora | =30 | |
| Fedoraproject Fedora | =31 | |
| Redhat Openstack | =15 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1783319
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1783324
- https://pivotal.io/security/cve-2019-11287
- https://access.redhat.com/errata/RHSA-2020:0078
- https://access.redhat.com/security/cve/cve-2019-11287
- https://bugzilla.redhat.com/show_bug.cgi?id=1783318
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin
- https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/
Frequently Asked Questions
What is CVE-2019-11287?
CVE-2019-11287 is a vulnerability in Pivotal RabbitMQ and RabbitMQ for Pivotal Platform that allows for a denial of service attack.
Which versions of Pivotal RabbitMQ are affected by CVE-2019-11287?
Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1 are affected by CVE-2019-11287.
Which versions of RabbitMQ for Pivotal Platform are affected by CVE-2019-11287?
RabbitMQ for Pivotal Platform 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4 are affected by CVE-2019-11287.
What is the severity of CVE-2019-11287?
CVE-2019-11287 has a severity rating of high.
How do I fix CVE-2019-11287?
To fix CVE-2019-11287, update Pivotal RabbitMQ to version 3.7.21 or later, and update RabbitMQ for Pivotal Platform to version 1.16.7 or later.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11287
- agent/software-canonical-lookup
- vendor/pivotal software
- canonical/pivotal software rabbitmq
- version/pivotal software rabbitmq/1.16.0
- version/pivotal software rabbitmq/1.17.0
- version/pivotal software rabbitmq/3.7.0
- vendor/vmware
- canonical/vmware rabbitmq
- version/vmware rabbitmq/3.8.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30
- version/fedoraproject fedora/31
- vendor/redhat
- canonical/redhat openstack
- version/redhat openstack/15
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/redhat