CVE-2014-9650
Fixed in a distro release EPSS 3%
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Products: broadcom rabbitmq_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rabbitmq-server | 3.4.1-1 |
| Debian 13 | rabbitmq-server | 3.4.1-1 |
| Debian 14 | rabbitmq-server | 3.4.1-1 |
| Red Hat openstack 5 | rabbitmq-server | 0:3.1.5-6.1.el6ost |
| Red Hat openstack 5 | rabbitmq-server | 0:3.3.5-18.el7ost |
| Red Hat openstack 6 | rabbitmq-server | 0:3.3.5-18.el7ost |
| Red Hat openstack 7 | rabbitmq-server | 0:3.3.5-18.el7ost |