RHSA-2020:0078HighCVSS 7.5

Red Hat Security Advisory: rabbitmq-server security update

Published
January 13, 2020
Last Modified
October 20, 2026

🔗 CVE IDs covered (2)

CVE-2019-11281 →CVE-2019-11287 →

📋 Description

CVE-2019-11281 — rabbitmq-server: improper sanitization of vhost limits and federation management UI pages CVE-2019-11287 — rabbitmq-server: "X-Reason" HTTP Header can be leveraged to insert a malicious string leading to DoS

🎯 Affected products4

  • Red Hat OpenStack Platform 15.0
  • rabbitmq-server-0:3.7.22-1.el8ost.ppc64le as a component of Red Hat OpenStack Platform 15.0
  • rabbitmq-server-0:3.7.22-1.el8ost.src as a component of Red Hat OpenStack Platform 15.0
  • rabbitmq-server-0:3.7.22-1.el8ost.x86_64 as a component of Red Hat OpenStack Platform 15.0

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There is no mitigation for this issue, the flaw can only be resolved by applying updates. Workaround: This flaw can be mitigated by disabling the Web Management plugin: rabbitmq-plugins disable rabbitmq_management.

🔗 References (4)