rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin(), and rabbitmq-c accepts the value in amqplogininner() in librabbitmq/amqpsocket.c. amqptuneconnection() in librabbitmq/amqpconnection.c uses framemax to reallocate the outbound buffer without enforcing AMQPFRAMEMINSIZE. Immediate serialization of connection.tune-ok through amqpframetobytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.

An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments.

https://github.com/alanxz/rabbitmq-c/issues/575 https://github.com/alanxz/rabbitmq-c/pull/781