CVE-2023-46120

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8	Patch
https://github.com/rabbitmq/rabbitmq-java-client/issues/1062	Issue Tracking Patch
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0	Release Notes
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h	Exploit Vendor Advisory
https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8	Patch
https://github.com/rabbitmq/rabbitmq-java-client/issues/1062	Issue Tracking Patch
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0	Release Notes
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-25 18:17

Updated : 2024-11-21 08:27

NVD link : CVE-2023-46120

Mitre link : CVE-2023-46120

CVE.ORG link : CVE-2023-46120

JSON object : View

Products Affected

vmware

rabbitmq_java_client

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-46120", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-10-25T18:17:36.257", "references": [{"url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/issues/1062", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0."}, {"lang": "es", "value": "La librer\u00eda cliente Java RabbitMQ permite que las aplicaciones basadas en Java y JVM se conecten e interact\u00faen con los nodos RabbitMQ. `maxBodyLebgth` no se us\u00f3 al recibir objetos de mensaje. Los atacantes podr\u00edan enviar un mensaje muy grande provocando un desbordamiento de la memoria y desencadenando un error OOM. Los usuarios de RabbitMQ pueden sufrir ataques DoS del cliente Java RabbitMQ que, en \u00faltima instancia, agotar\u00e1n la memoria del consumidor. Esta vulnerabilidad fue parcheada en la versi\u00f3n 5.18.0."}], "lastModified": "2024-11-21T08:27:55.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41FC145C-896D-47CD-A362-57F4A21BE730", "versionEndExcluding": "5.18.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}