CVE-2023-46120
First published: Tue Oct 24 2023(Updated: )
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vmware Rabbitmq Java Client | <5.18.0 | |
| maven/com.rabbitmq:amqp-client | <5.18.0 | 5.18.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
- https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
- https://nvd.nist.gov/vuln/detail/CVE-2023-46120
- https://github.com/advisories/GHSA-mm8h-8587-p46h (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-46120.
What is the summary of CVE-2023-46120 vulnerability?
The summary of CVE-2023-46120 vulnerability is that the `maxBodyLebgth` parameter was not used when receiving Message objects, allowing attackers to send a large message causing a memory overflow and triggering an Out-of-Memory (OOM) error.
What is the severity score of CVE-2023-46120?
The severity score of CVE-2023-46120 is 4.9 (medium severity).
How can the CVE-2023-46120 vulnerability be exploited?
The CVE-2023-46120 vulnerability can be exploited by an attacker sending a very large Message to trigger a memory overflow and an Out-of-Memory (OOM) error.
What software is affected by CVE-2023-46120?
The affected software for CVE-2023-46120 is RabbitMQ version up to 5.18.0.
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-mm8h-8587-p46h
- alias/CVE-2023-46120
- collector/github-advisory
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/tags
- agent/type
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- vendor/vmware
- canonical/vmware rabbitmq java client
- package-manager/maven