3:50 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Bug ID: 1448335
Summary: CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aortega(a)redhat.com, apevec(a)redhat.com,
ayoung(a)redhat.com, chrisw(a)redhat.com,
cvsbot-xmlrpc(a)redhat.com,
erlang(a)lists.fedoraproject.org,
hubert.plociniczak(a)gmail.com, jeckersb(a)redhat.com,
jjoyce(a)redhat.com, josh(a)fornwall.com,
jschluet(a)redhat.com, kbasil(a)redhat.com,
lemenkov(a)gmail.com, lhh(a)redhat.com, lpeer(a)redhat.com,
markmc(a)redhat.com, plemenko(a)redhat.com,
rbryant(a)redhat.com, rjones(a)redhat.com,
sclewis(a)redhat.com, sisharma(a)redhat.com,
srevivo(a)redhat.com, s(a)shk.io, tdecacqu(a)redhat.com
A cross site scripting vulnerability was found in the management UI of
RabbitMQ.
External References:
https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_9
--
You are receiving this mail because:
You are on the CC list for the bug.
3:50 a.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |rabbitmq-server 3.6.9
--
You are receiving this mail because:
You are on the CC list for the bug.
3:55 a.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1448338, 1448339
--- Comment #1 from Andrej Nemec <anemec(a)redhat.com> ---
Created rabbitmq-server tracking bugs for this issue:
Affects: epel-all [bug 1448338]
Affects: fedora-24 [bug 1448339]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1448338
[Bug 1448338] CVE-2017-4965 CVE-2017-4966 CVE-2017-4967 rabbitmq-server:
various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1448339
[Bug 1448339] CVE-2017-4965 CVE-2017-4966 CVE-2017-4967 rabbitmq-server:
various flaws [fedora-24]
--
You are receiving this mail because:
You are on the CC list for the bug.
7:34 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1448341
--
You are receiving this mail because:
You are on the CC list for the bug.
7:34 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Garth Mollett <gmollett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0329,reported=20170422,sour |0329,reported=20170422,sour
|ce=gentoo,cvss3=6.1/CVSS:3. |ce=gentoo,cvss3=6.1/CVSS:3.
|0/AV:N/AC:L/PR:N/UI:R/S:C/C |0/AV:N/AC:L/PR:N/UI:R/S:C/C
|:L/I:L/A:N,cwe=CWE-79,fedor |:L/I:L/A:N,cwe=CWE-79,fedor
|a-24/rabbitmq-server=affect |a-24/rabbitmq-server=affect
|ed,fedora-25/rabbitmq-serve |ed,fedora-25/rabbitmq-serve
|r=notaffected,epel-all/rabb |r=notaffected,epel-all/rabb
|itmq-server=affected,rhscon |itmq-server=affected,rhscon
|-2/rabbitmq-server=new,open |-2/rabbitmq-server=affected
|stack-5/rabbitmq-server=new |,openstack-5/rabbitmq-serve
|,openstack-6/rabbitmq-serve |r=new,openstack-6/rabbitmq-
|r=new,openstack-7/rabbitmq- |server=new,openstack-7/rabb
|server=new,openstack-8/rabb |itmq-server=new,openstack-8
|itmq-server=new,openstack-9 |/rabbitmq-server=new,openst
|/rabbitmq-server=new,openst |ack-9/rabbitmq-server=new,o
|ack-10/rabbitmq-server=new, |penstack-10/rabbitmq-server
|openstack-11/rabbitmq-serve |=new,openstack-11/rabbitmq-
|r=new |server=new
--
You are receiving this mail because:
You are on the CC list for the bug.
7:36 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Garth Mollett <gmollett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0329,reported=20170422,sour |0329,reported=20170422,sour
|ce=gentoo,cvss3=6.1/CVSS:3. |ce=gentoo,cvss3=6.1/CVSS:3.
|0/AV:N/AC:L/PR:N/UI:R/S:C/C |0/AV:N/AC:L/PR:N/UI:R/S:C/C
|:L/I:L/A:N,cwe=CWE-79,fedor |:L/I:L/A:N,cwe=CWE-79,fedor
|a-24/rabbitmq-server=affect |a-24/rabbitmq-server=affect
|ed,fedora-25/rabbitmq-serve |ed,fedora-25/rabbitmq-serve
|r=notaffected,epel-all/rabb |r=notaffected,epel-all/rabb
|itmq-server=affected,rhscon |itmq-server=affected,rhscon
|-2/rabbitmq-server=affected |-2/rabbitmq-server=new,open
|,openstack-5/rabbitmq-serve |stack-5/rabbitmq-server=new
|r=new,openstack-6/rabbitmq- |,openstack-6/rabbitmq-serve
|server=new,openstack-7/rabb |r=new,openstack-7/rabbitmq-
|itmq-server=new,openstack-8 |server=new,openstack-8/rabb
|/rabbitmq-server=new,openst |itmq-server=new,openstack-9
|ack-9/rabbitmq-server=new,o |/rabbitmq-server=new,openst
|penstack-10/rabbitmq-server |ack-10/rabbitmq-server=new,
|=new,openstack-11/rabbitmq- |openstack-11/rabbitmq-serve
|server=new |r=new
--
You are receiving this mail because:
You are on the CC list for the bug.
10:29 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Summer Long <slong(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0329,reported=20170422,sour |0329,reported=20170422,sour
|ce=gentoo,cvss3=6.1/CVSS:3. |ce=gentoo,cvss3=6.1/CVSS:3.
|0/AV:N/AC:L/PR:N/UI:R/S:C/C |0/AV:N/AC:L/PR:N/UI:R/S:C/C
|:L/I:L/A:N,cwe=CWE-79,fedor |:L/I:L/A:N,cwe=CWE-79,fedor
|a-24/rabbitmq-server=affect |a-24/rabbitmq-server=affect
|ed,fedora-25/rabbitmq-serve |ed,fedora-25/rabbitmq-serve
|r=notaffected,epel-all/rabb |r=notaffected,epel-all/rabb
|itmq-server=affected,rhscon |itmq-server=affected,rhscon
|-2/rabbitmq-server=new,open |-2/rabbitmq-server=new,open
|stack-5/rabbitmq-server=new |stack-5/rabbitmq-server=won
|,openstack-6/rabbitmq-serve |tfix,openstack-6/rabbitmq-s
|r=new,openstack-7/rabbitmq- |erver=wontfix,openstack-7/r
|server=new,openstack-8/rabb |abbitmq-server=wontfix,open
|itmq-server=new,openstack-9 |stack-8/rabbitmq-server=won
|/rabbitmq-server=new,openst |tfix,openstack-9/rabbitmq-s
|ack-10/rabbitmq-server=new, |erver=wontfix,openstack-10/
|openstack-11/rabbitmq-serve |rabbitmq-server=wontfix,ope
|r=new |nstack-11/rabbitmq-server=w
| |ontfix
--
You are receiving this mail because:
You are on the CC list for the bug.
11:22 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Siddharth Sharma <sisharma(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0329,reported=20170422,sour |0329,reported=20170422,sour
|ce=gentoo,cvss3=6.1/CVSS:3. |ce=gentoo,cvss3=6.1/CVSS:3.
|0/AV:N/AC:L/PR:N/UI:R/S:C/C |0/AV:N/AC:L/PR:N/UI:R/S:C/C
|:L/I:L/A:N,cwe=CWE-79,fedor |:L/I:L/A:N,cwe=CWE-79,fedor
|a-24/rabbitmq-server=affect |a-24/rabbitmq-server=affect
|ed,fedora-25/rabbitmq-serve |ed,fedora-25/rabbitmq-serve
|r=notaffected,epel-all/rabb |r=notaffected,epel-all/rabb
|itmq-server=affected,rhscon |itmq-server=affected,rhscon
|-2/rabbitmq-server=new,open |-2/rabbitmq-server=wontfix,
|stack-5/rabbitmq-server=won |openstack-5/rabbitmq-server
|tfix,openstack-6/rabbitmq-s |=wontfix,openstack-6/rabbit
|erver=wontfix,openstack-7/r |mq-server=wontfix,openstack
|abbitmq-server=wontfix,open |-7/rabbitmq-server=wontfix,
|stack-8/rabbitmq-server=won |openstack-8/rabbitmq-server
|tfix,openstack-9/rabbitmq-s |=wontfix,openstack-9/rabbit
|erver=wontfix,openstack-10/ |mq-server=wontfix,openstack
|rabbitmq-server=wontfix,ope |-10/rabbitmq-server=wontfix
|nstack-11/rabbitmq-server=w |,openstack-11/rabbitmq-serv
|ontfix |er=wontfix
--
You are receiving this mail because:
You are on the CC list for the bug.
10:56 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Summer Long <slong(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment #3 is|1 |0
private| |
CC| |slong(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
2:37 a.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
--- Comment #4 from Adam Mariš <amaris(a)redhat.com> ---
Statement:
This issue affects rabbitmq-server plugins as shipped with:
* Red Hat Storage Console 2
* Red Hat Enterprise Linux OpenStack Platform 5,6,7
* Red Hat OpenStack Platform 8,9,10,11
Although RabbitMQ plugins are shipped in these products, no plugins are enabled
or used by default.
To verify your environment's plugin usage, run:
# rabbitmq-plugins list
A future update may address this issue. Red Hat Product Security has rated this
issue as having Moderate security impact. For additional information, refer to
the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/.
--
You are receiving this mail because:
You are on the CC list for the bug.
7:55 p.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Summer Long <slong(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2017-07-02 20:55:46
--
You are receiving this mail because:
You are on the CC list for the bug.
3:41 a.m.
New subject: [Bug 1448335] CVE-2017-4965 rabbitmq: XSS vulnerability in
management UI
https://bugzilla.redhat.com/show_bug.cgi?id=1448335
Bug 1448335 depends on bug 1448339, which changed state.
Bug 1448339 Summary: CVE-2017-4965 CVE-2017-4966 CVE-2017-4967 rabbitmq-server: various
flaws [fedora-24]
https://bugzilla.redhat.com/show_bug.cgi?id=1448339
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
2031
days inactive
2546
days old
erlang@lists.fedoraproject.org
11 comments
1 participants
participants (1)
-
bugzilla＠redhat.com