VAR-201911-1657
Vulnerability from variot - Updated: 2025-04-02 19:57Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing. Pivotal RabbitMQ and RabbitMQ for Pivotal Platform Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. ========================================================================== Ubuntu Security Notice USN-5004-1 June 24, 2021
rabbitmq-server vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in rabbitmq-server.
Software Description: - rabbitmq-server: AMQP server written in Erlang
Details:
It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)
Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-22116)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.04: rabbitmq-server 3.8.9-2ubuntu0.1
Ubuntu 20.10: rabbitmq-server 3.8.5-1ubuntu0.2
Ubuntu 20.04 LTS: rabbitmq-server 3.8.2-0ubuntu1.3
Ubuntu 18.04 LTS: rabbitmq-server 3.6.10-1ubuntu0.5
Ubuntu 16.04 ESM: rabbitmq-server 3.5.7-1ubuntu0.16.04.4+esm1
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: rabbitmq-server security update Advisory ID: RHSA-2020:0078-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2020:0078 Issue date: 2020-01-13 CVE Names: CVE-2019-11287 =====================================================================
- Summary:
An update for rabbitmq-server is now available for Red Hat OpenStack Platform 15 (Stein).
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat OpenStack Platform 15.0 - ppc64le, x86_64
- Description:
RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.
Security Fix(es):
- "X-Reason" HTTP Header can be leveraged to insert a malicious string leading to DoS (CVE-2019-11287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Package List:
Red Hat OpenStack Platform 15.0:
Source: rabbitmq-server-3.7.22-1.el8ost.src.rpm
ppc64le: rabbitmq-server-3.7.22-1.el8ost.ppc64le.rpm
x86_64: rabbitmq-server-3.7.22-1.el8ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2019-11287 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXhxCd9zjgjWX9erEAQhcJhAAkFi7Cpsx7AQav3E+LgCF0GblFmJWFP3L qg5F2/2FFdd1fFfHN3FvT9km571u1Hm9oPjKe4g2SgkrOmsP+mEsqD6nXHg1vHGw yOZ4GSGO0bde/Zj5USrmxFIwZcmbl5MzIrCqtx9fNPQPZzI4Hk8qmpINvc6wBZFs aZafHly3mPvxP28rAnEtkjUCEzRuXnovQDrCW8sfNCT1Vhayg+A0cS2iM8rHak25 SNlac9rq3dVkw1wWdgeVmNwu1bCcKopXLYrwVC70esX9fZxnCtPB0iTjy3g4qvxV xfcdsLLQOAYQZdBDtn1M+1GjjG7NLqcP6jD8ySBM+uNwyNiH20LpXmMO9ShysM31 BrYG+aNJyb8AmrMtNF/MijJqv1SYakhHANK0OsdkgGokZWss7yhe7qOpZVU83z41 owwpUrSsBO2xRb85nzo7AcoI0na/f965KyQjt7P1stMiTaXd84VucWlNcEH+I4ox 0zbC4AWgKTbvnMNA2WDSPpx2fkcBS3PdjBi/1MqGES6srz+4oH8MunlqojqKjK9j /YkttwQD78cswQPm1LBaZNaFpqtFnFnAjN18E+phb2Y01hTCvwqVj05fp+eDNQM+ N20HEjc8EDWAmyOGqripUnQ+rRBuPSfkU686szcZwrHFqrz/sh8h0qFRca/Za+4v qUGcuX2aS7Q= =/zG9 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201911-1657",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "rabbitmq",
"scope": "lt",
"trust": 1.0,
"vendor": "pivotal",
"version": "1.16.7"
},
{
"model": "rabbitmq",
"scope": "gte",
"trust": 1.0,
"vendor": "pivotal",
"version": "1.17.0"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 1.0,
"vendor": "pivotal",
"version": "1.17.4"
},
{
"model": "rabbitmq server",
"scope": "lt",
"trust": 1.0,
"vendor": "broadcom",
"version": "3.8.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "rabbitmq server",
"scope": "gte",
"trust": 1.0,
"vendor": "broadcom",
"version": "3.8.0"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "30"
},
{
"model": "openstack",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "15"
},
{
"model": "rabbitmq",
"scope": "gte",
"trust": 1.0,
"vendor": "pivotal",
"version": "1.16.0"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 1.0,
"vendor": "pivotal",
"version": "3.7.21"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "31"
},
{
"model": "rabbitmq",
"scope": "gte",
"trust": 1.0,
"vendor": "pivotal",
"version": "3.7.0"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 0.8,
"vendor": "pivotal",
"version": "3.7"
},
{
"model": "rabbitmq",
"scope": "eq",
"trust": 0.8,
"vendor": "pivotal",
"version": "3.8.1"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 0.8,
"vendor": "pivotal",
"version": "1.17.x"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 0.8,
"vendor": "pivotal",
"version": "1.16.x"
},
{
"model": "rabbitmq",
"scope": "eq",
"trust": 0.8,
"vendor": "pivotal",
"version": "3.7.21"
},
{
"model": "rabbitmq",
"scope": "eq",
"trust": 0.8,
"vendor": "pivotal",
"version": "for pivotal platform 1.16.7"
},
{
"model": "rabbitmq",
"scope": "eq",
"trust": 0.8,
"vendor": "pivotal",
"version": "for pivotal platform 1.17.4"
},
{
"model": "rabbitmq",
"scope": "lt",
"trust": 0.8,
"vendor": "pivotal",
"version": "3.8"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:pivotal_software:rabbitmq",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "155914"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
}
],
"trust": 0.7
},
"cve": "CVE-2019-11287",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2019-11287",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2019-11287",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "security@pivotal.io",
"availabilityImpact": "HIGH",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 0.9,
"id": "CVE-2019-11287",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-11287",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-11287",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "security@pivotal.io",
"id": "CVE-2019-11287",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-11287",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201911-1307",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The \"X-Reason\" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing. Pivotal RabbitMQ and RabbitMQ for Pivotal Platform Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. ==========================================================================\nUbuntu Security Notice USN-5004-1\nJune 24, 2021\n\nrabbitmq-server vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 21.04\n- Ubuntu 20.10\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in rabbitmq-server. \n\nSoftware Description:\n- rabbitmq-server: AMQP server written in Erlang\n\nDetails:\n\nIt was discovered that RabbitMQ incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)\n\nJonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a denial of service. \n(CVE-2021-22116)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 21.04:\n rabbitmq-server 3.8.9-2ubuntu0.1\n\nUbuntu 20.10:\n rabbitmq-server 3.8.5-1ubuntu0.2\n\nUbuntu 20.04 LTS:\n rabbitmq-server 3.8.2-0ubuntu1.3\n\nUbuntu 18.04 LTS:\n rabbitmq-server 3.6.10-1ubuntu0.5\n\nUbuntu 16.04 ESM:\n rabbitmq-server 3.5.7-1ubuntu0.16.04.4+esm1\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: rabbitmq-server security update\nAdvisory ID: RHSA-2020:0078-01\nProduct: Red Hat Enterprise Linux OpenStack Platform\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:0078\nIssue date: 2020-01-13\nCVE Names: CVE-2019-11287 \n=====================================================================\n\n1. Summary:\n\nAn update for rabbitmq-server is now available for Red Hat OpenStack\nPlatform 15 (Stein). \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat OpenStack Platform 15.0 - ppc64le, x86_64\n\n3. Description:\n\nRabbitMQ is an implementation of AMQP, the emerging standard for high\nperformance enterprise messaging. The RabbitMQ server is a robust and\nscalable implementation of an AMQP broker. \n\nSecurity Fix(es):\n\n* \"X-Reason\" HTTP Header can be leveraged to insert a malicious string\nleading to DoS (CVE-2019-11287)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat OpenStack Platform 15.0:\n\nSource:\nrabbitmq-server-3.7.22-1.el8ost.src.rpm\n\nppc64le:\nrabbitmq-server-3.7.22-1.el8ost.ppc64le.rpm\n\nx86_64:\nrabbitmq-server-3.7.22-1.el8ost.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-11287\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXhxCd9zjgjWX9erEAQhcJhAAkFi7Cpsx7AQav3E+LgCF0GblFmJWFP3L\nqg5F2/2FFdd1fFfHN3FvT9km571u1Hm9oPjKe4g2SgkrOmsP+mEsqD6nXHg1vHGw\nyOZ4GSGO0bde/Zj5USrmxFIwZcmbl5MzIrCqtx9fNPQPZzI4Hk8qmpINvc6wBZFs\naZafHly3mPvxP28rAnEtkjUCEzRuXnovQDrCW8sfNCT1Vhayg+A0cS2iM8rHak25\nSNlac9rq3dVkw1wWdgeVmNwu1bCcKopXLYrwVC70esX9fZxnCtPB0iTjy3g4qvxV\nxfcdsLLQOAYQZdBDtn1M+1GjjG7NLqcP6jD8ySBM+uNwyNiH20LpXmMO9ShysM31\nBrYG+aNJyb8AmrMtNF/MijJqv1SYakhHANK0OsdkgGokZWss7yhe7qOpZVU83z41\nowwpUrSsBO2xRb85nzo7AcoI0na/f965KyQjt7P1stMiTaXd84VucWlNcEH+I4ox\n0zbC4AWgKTbvnMNA2WDSPpx2fkcBS3PdjBi/1MqGES6srz+4oH8MunlqojqKjK9j\n/YkttwQD78cswQPm1LBaZNaFpqtFnFnAjN18E+phb2Y01hTCvwqVj05fp+eDNQM+\nN20HEjc8EDWAmyOGqripUnQ+rRBuPSfkU686szcZwrHFqrz/sh8h0qFRca/Za+4v\nqUGcuX2aS7Q=\n=/zG9\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-11287"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "PACKETSTORM",
"id": "163278"
},
{
"db": "PACKETSTORM",
"id": "155914"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-11287",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012564",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "163278",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "155914",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.0135",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2233",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2432",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "PACKETSTORM",
"id": "163278"
},
{
"db": "PACKETSTORM",
"id": "155914"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"id": "VAR-201911-1657",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.625
},
"last_update_date": "2025-04-02T19:57:39.118000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "CVE-2019-11287: RabbitMQ Web Management Plugin DoS via heap overflow",
"trust": 0.8,
"url": "https://pivotal.io/security/cve-2019-11287"
},
{
"title": "Pivotal Software RabbitMQ Remediation of resource management error vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=104058"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-400",
"trust": 1.8
},
{
"problemtype": "CWE-134",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "https://access.redhat.com/errata/rhsa-2020:0078"
},
{
"trust": 2.2,
"url": "https://pivotal.io/security/cve-2019-11287"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-11287"
},
{
"trust": 1.6,
"url": "https://github.com/drunkenshells/disclosures/tree/master/cve-2019-11287-dos%20via%20heap%20overflow-rabbitmq%20web%20management%20plugin"
},
{
"trust": 1.6,
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"
},
{
"trust": 1.4,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11287"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/pytgr3d5fw2o25rxzotizmod2hauvbe4/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/eeq6o7pmnjkyfmqyhab55l423gyk63so/"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/cve/cve-2019-11287"
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/pytgr3d5fw2o25rxzotizmod2hauvbe4/"
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/eeq6o7pmnjkyfmqyhab55l423gyk63so/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/163278/ubuntu-security-notice-usn-5004-1.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/155914/red-hat-security-advisory-2020-0078-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2432"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2233"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.0135/"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.6.10-1ubuntu0.5"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.9-2ubuntu0.1"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5004-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.5-1ubuntu0.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.2-0ubuntu1.3"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22116"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "PACKETSTORM",
"id": "163278"
},
{
"db": "PACKETSTORM",
"id": "155914"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"db": "PACKETSTORM",
"id": "163278"
},
{
"db": "PACKETSTORM",
"id": "155914"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"date": "2021-06-24T17:57:46",
"db": "PACKETSTORM",
"id": "163278"
},
{
"date": "2020-01-13T18:04:22",
"db": "PACKETSTORM",
"id": "155914"
},
{
"date": "2019-11-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"date": "2019-11-23T00:15:10.683000",
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012564"
},
{
"date": "2021-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-1307"
},
{
"date": "2025-04-02T14:13:43.180000",
"db": "NVD",
"id": "CVE-2019-11287"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pivotal RabbitMQ and RabbitMQ for Pivotal Platform Vulnerable to resource exhaustion",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012564"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "format string error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-1307"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.