Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rabbitmq rabbitmq-server
>= 4.2.0, < 4.2.6affected>= 4.1.0, < 4.1.11affected>= 4.0.0, < 4.0.21affected>= 3.13.0, < 3.13.15affected
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15941 ↗
- https://github.com/rabbitmq/rabbitmq-server/pull/15943 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36 ↗
- https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c ↗
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 ↗