Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rabbitmq rabbitmq-server
>= 4.2.0, < 4.2.6affected>= 4.1.0, < 4.1.11affected>= 4.0.0, < 4.0.21affected>= 3.13.0, < 3.13.15affected
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3 ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15935 ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15938 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72 ↗
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 ↗