Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rabbitmq rabbitmq-server
>= 4.2.0, < 4.2.6affected>= 4.1.0, < 4.1.11affected>= 4.0.0, < 4.0.21affected>= 3.13.0, < 3.13.15affected
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15936 ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15940 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/7273c9eb6920abcde17b892dbe97ccaf906ead47 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/9f8c39fcf0acbc43080ee7017a62a02832114112 ↗
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 ↗