Source: rabbitmq-java-client Version: 5.0.0-2 X-Debbugs-CC: [email protected] Severity: impoortant Tags: security upstream
Hi, The following vulnerability was published for rabbitmq-java-client. CVE-2023-46120[0]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. | `maxBodyLebgth` was not used when receiving Message objects. | Attackers could send a very large Message causing a memory overflow | and triggering an OOM Error. Users of RabbitMQ may suffer from DoS | attacks from RabbitMQ Java client which will ultimately exhaust the | memory of the consumer. This vulnerability was patched in version | 5.18.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-46120 https://www.cve.org/CVERecord?id=CVE-2023-46120 [1] https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h [2] https://github.com/rabbitmq/rabbitmq-java-client/issues/1062 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
