Upgrade to RabbitMQ 3.6.1 about cf-rabbitmq-release

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/115456143.

[michaelklishin]

There are but no promises on the ETA. Note that the attacker in said CVE needs to have access to management UI which greatly reduces the severity in my opinion.

On 11 mar 2016, at 0:23, MatthiasTe [email protected] wrote:

Are there any plans to upgrade the RabbitMQ version to 3.6.1?
This would fix the security issue (CVE-2015-8786) in the management plugin

—
Reply to this email directly or view it on GitHub.

[MatthiasTe]

One might discuss the servility of the issue.

According to my analysis, an attacker or bad client code could issue an http get on http://:/api/overview? which will kill the RabbitMQ node. As host, port, user and password is available at the VCAP parameters, this issue can be accessed by any bound cloud foundry application. So a CF application can bring down the cluster with low effort. At some of my tests, the RabbitMQ nodes did not recover or restart automatically as well …

PS: (I don’t like to mention the bad query options here, but you may send me a mail to get that detail)

[davidhiston]

Hi Matthias,

We are planning to release this soon, but thank you for highlighting the
above to us.

Thanks,

Dave

On 11 March 2016 at 13:55, MatthiasTe [email protected] wrote:

One might discuss the servility of the issue.

According to my analysis, an attacker or bad client code could issue an
http get on http://:/api/overview? which will kill the RabbitMQ node. As
host, port, user and password is available at the VCAP parameters, this
issue can be accessed by any bound cloud foundry application. So a CF
application can bring down the cluster with low effort. At some of my
tests, the RabbitMQ nodes did not recover or restart automatically as well …

PS: (I don’t like to mention the bad query options here, but you may send
me a mail to get that detail)

—
Reply to this email directly or view it on GitHub
#23 (comment)
.

[davidhiston]

Hi Matthias,
I am closing this issue as the release has now been updated to 3.6.1.