Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Description
mechanisms/1 calls [list_to_atom(T) || T <- string:tokens(Mech, ":")] on every auth_mechanism query value. A single ~9 MB PUT fits roughly 1M colon-separated tokens, and each becomes a permanent atom, crashing the node in one to three requests.
Preconditions
The Shovel or Federation plugin must be in use. Setting auth_mechanism requires the policymaker tag.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (5.9, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Description
mechanisms/1calls[list_to_atom(T) || T <- string:tokens(Mech, ":")]on everyauth_mechanismquery value. A single ~9 MBPUTfits roughly 1M colon-separated tokens, and each becomes a permanent atom, crashing the node in one to three requests.Preconditions
The Shovel or Federation plugin must be in use. Setting
auth_mechanismrequires thepolicymakertag.CVSS
CVSS v4.0:
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N(5.9, Moderate). Fixed in3.13.15,4.0.20,4.1.11,4.2.6,4.3.0.