CVE-2019-11287
Fixed in a distro release EPSS 4%CVSS 4.5
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Products: RabbitMQ for Pivotal Platform, Pivotal RabbitMQ
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rabbitmq-server | 3.8.3-1 |
| Debian 13 | rabbitmq-server | 3.8.3-1 |
| Debian 14 | rabbitmq-server | 3.8.3-1 |
| Debian 9 | rabbitmq-server | 3.6.6-1+deb9u1 |
| Red Hat openstack 15 | rabbitmq-server | 0:3.7.22-1.el8ost |
| SUSE HPE Helion OpenStack 8 | ardana-ansible | 8.0+git.1660773729.3789a6d-3.85.1 |
| SUSE HPE Helion OpenStack 8 | ardana-cobbler | 8.0+git.1660773402.d845a45-3.47.1 |
| SUSE HPE Helion OpenStack 8 | grafana | 6.7.4-4.23.1 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 |
| SUSE HPE Helion OpenStack 8 | openstack-murano | 4.0.2~dev3-3.12.1 |
| SUSE HPE Helion OpenStack 8 | openstack-murano-doc | 4.0.2~dev3-3.12.1 |
| SUSE HPE Helion OpenStack 8 | python-Django | 1.11.29-3.42.1 |
| SUSE HPE Helion OpenStack 8 | rabbitmq-server | 3.6.16-3.13.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.45.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.48.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-murano | 4.0.2~dev3-12.38.1 |
| SUSE OpenStack Cloud 8 | ardana-ansible | 8.0+git.1660773729.3789a6d-3.85.1 |
| SUSE OpenStack Cloud 8 | ardana-cobbler | 8.0+git.1660773402.d845a45-3.47.1 |
| SUSE OpenStack Cloud 8 | grafana | 6.7.4-4.23.1 |
| SUSE OpenStack Cloud 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 |
| SUSE OpenStack Cloud 8 | openstack-murano | 4.0.2~dev3-3.12.1 |
| SUSE OpenStack Cloud 8 | openstack-murano-doc | 4.0.2~dev3-3.12.1 |
| SUSE OpenStack Cloud 8 | python-Django | 1.11.29-3.42.1 |
| SUSE OpenStack Cloud 8 | rabbitmq-server | 3.6.16-3.13.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.45.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.48.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-murano | 4.0.2~dev3-12.38.1 |
| SUSE OpenStack Cloud 9 | ardana-ansible | 9.0+git.1660748476.c118d23-3.32.1 |
| SUSE OpenStack Cloud 9 | ardana-cobbler | 9.0+git.1660747489.119efcd-3.19.1 |
| SUSE OpenStack Cloud 9 | ardana-tempest | 9.0+git.1651855288.a2341ad-3.22.1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.29.1 |
| SUSE OpenStack Cloud 9 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a7-3.15.1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev4-3.12.1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev46-3.34.1 |
| SUSE OpenStack Cloud 9 | openstack-nova | 18.3.1~dev92-3.43.1 |
| SUSE OpenStack Cloud 9 | python-Django1 | 1.11.29-3.40.1 |
| SUSE OpenStack Cloud 9 | rabbitmq-server | 3.6.16-4.3.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.37.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.41.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.41.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.41.1 |
| SUSE OpenStack Cloud Crowbar 8 | grafana | 6.7.4-4.23.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a-3.27.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-murano | 4.0.2~dev3-3.12.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-murano-doc | 4.0.2~dev3-3.12.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Django | 1.11.29-3.42.1 |
| SUSE OpenStack Cloud Crowbar 8 | rabbitmq-server | 3.6.16-3.13.1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-puma | 2.16.0-3.18.1 |
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.29.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-templates | 0.0.0+git.1654529662.75fa04a7-3.15.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev4-3.12.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev46-3.34.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-nova | 18.3.1~dev92-3.43.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Django1 | 1.11.29-3.40.1 |
| SUSE OpenStack Cloud Crowbar 9 | rabbitmq-server | 3.6.16-4.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-puma | 2.16.0-4.18.1 |
| Ubuntu 18.04 LTS | rabbitmq-server | 3.6.10-1ubuntu0.5 |
| Ubuntu 20.04 LTS | rabbitmq-server | 3.8.2-0ubuntu1.3 |
| Ubuntu Pro 16.04 LTS | rabbitmq-server | 3.5.7-1ubuntu0.16.04.4+esm1 |