CVE-2023-46118 Denial of Service by publishing large messages over the HTTP API
Authenticated users can cause denial of service by publishing excessively large messages via the HTTP API, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46118?
CVE-2023-46118 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 24 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Weakness: CWE-400
Which versions are affected by CVE-2023-46118?
5 open source packages ship an affected version, including rabbit_common and rabbitmq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rabbit_common Hex | From 3.11.0 | 3.11.24 |
rabbit_common Hex | From 3.11.0 | 3.11.24 |
rabbit_common Hex | From 3.12.0 | 3.12.7 |
rabbit_common Hex | From 3.12.0 | 3.12.7 |
rabbitmq Bitnami | All versions | 3.11.24, 3.12.7 |
Linux distribution packages (5)
rabbitmq-server Red Hat:openstack:17.1::el9 | All versions | 0:3.9.10-3.el9ost |
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 3.8.11-150300.3.14.1 |
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP5 | All versions | 3.8.11-150300.3.14.1 |
rabbitmq-server openSUSE:Leap 15.4 | All versions | 3.8.11-150300.3.14.1 |
rabbitmq-server openSUSE:Leap 15.5 | All versions | 3.8.11-150300.3.14.1 |
Products include Vmware Rabbitmq.
How do I fix CVE-2023-46118?
Upgrade rabbit_common to a fixed version for your release line: 3.11.24 or 3.12.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46118 being exploited?
There is no known exploitation of CVE-2023-46118 in the wild and no public exploit code.
Other vulnerabilities in rabbitmq-server
Sources
Also known as AZL-32107, AZL-35196, BIT-rabbitmq-2023-46118, DEBIAN-CVE-2023-46118, DLA-3687-1, DSA-5571-1 and 5 more.