FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
6aa956fb-d97f-11e6-a071-001e67f15f5aRabbitMQ -- Authentication vulnerability

Pivotal.io reports:

MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.


Discovery 2016-12-06
Entry 2017-01-15
rabbitmq
ge 3.0.0 lt 3.5.8

ge 3.6.0 lt 3.6.6

CVE-2016-9877
https://pivotal.io/security/cve-2016-9877
https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6
8469d41c-a960-11e4-b18e-bcaec55be5e5rabbitmq -- Security issues in management plugin

The RabbitMQ project reports:

Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI:

  • When a user unqueued a message from the management UI, message details (header names, arguments, etc.) were displayed unescaped. An attacker could publish a specially crafted message to add content or execute arbitrary Javascript code on behalf of a user, if this user unqueued the message from the management UI.
  • When viewing policies, their name was displayed unescaped. An attacker could create a policy with a specially crafted name to add content or execute arbitrary Javascript code on behalf of a user who is viewing policies.
  • When listing connected AMQP network clients, client details such as its version were displayed unescaped. An attacker could use a client with a specially crafted version field to add content or execute arbitrary Javascript code on behalf of a user who is viewing connected clients.

In all cases, the attacker needs a valid user account on the targeted RabbitMQ cluster.

Furthermore, some admin-controllable content was not properly escaped:

  • user names;
  • the cluster name.

Likewise, an attacker could add content or execute arbitrary Javascript code on behalf of a user using the management web UI. However, the attacker must be an administrator on the RabbitMQ cluster, thus a trusted user.


Discovery 2015-01-08
Entry 2015-01-31
rabbitmq
< 3.4.3

http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100
http://www.rabbitmq.com/release-notes/README-3.4.3.txt
CVE-2015-0862
b1aa54ae-74cb-42a0-b462-cbb6831c5c50RabbitMQ -- Denial of Service in AMQP1.0 plugin

Pivotal.io reports:

All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint.


Discovery 2021-05-10
Entry 2021-05-10
rabbitmq
< 3.8.16

CVE-2016-9877
https://tanzu.vmware.com/security/cve-2021-22116
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.19
7003b62d-7252-46ff-a9df-1b1900f1e65bRabbitMQ -- Denial of Service via improper input validation

Jonathon Knudsen of Synopsys Cybersecurity Research Center reports:

All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious client can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.


Discovery 2021-05-10
Entry 2021-06-28
rabbitmq
< 3.8.16

CVE-2021-22116
https://tanzu.vmware.com/security/cve-2021-22116
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22116