CVEvulnerability

CVE-2019-11287

7.5 HIGH Published 2019-11-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-11-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
4.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-134, CWE-400

Description

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

Affected configurations

• broadcom rabbitmq server (>= 3.8.0 < 3.8.1) • pivotal software rabbitmq (>= 1.16.0 < 1.16.7) • pivotal software rabbitmq (>= 1.17.0 < 1.17.4) • pivotal software rabbitmq (>= 3.7.0 < 3.7.21) • fedoraproject fedora 30 • fedoraproject fedora 31 • redhat openstack 15 • debian debian linux 9.0

Related

Weakness · CWE (2)

  • CWE-134 Use of Externally-Controlled Format String weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References