Headline
CVE-2023-46120: Release v5.18.0 · rabbitmq/rabbitmq-java-client
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Changes between 5.17.0 and 5.18.0
This is a minor release with usability improvements and dependency upgrades. It is compatible with 5.17.x. All users of the 5.x.x series are encouraged to upgrade.
Inbound message size is now enforced, with default limit being 64 MiB.
Thanks to @JHahnHRO and Sérgio Faria (@sergio91pt) for their contribution.
Add ability to specify maximum message size
GitHub issue: #1062
Do not confirmSelect more than once per channel
GitHub PR: #1057
Make RpcClient (Auto)Closeable
GitHub issue: #1032
Bump dependencies
GitHub issue: #999
Dependency****Maven
<dependency> <groupId>com.rabbitmq</groupId> <artifactId>amqp-client</artifactId> <version>5.18.0</version> </dependency>
Gradle
compile ‘com.rabbitmq:amqp-client:5.18.0’
Related news
### Summary `maxBodyLebgth` was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error. ### PoC #### RbbitMQ * Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory) * Start RabbitMQ #### Producer * Build a String of length 256M and send it to Consumer ``` package org.springframework.amqp.helloworld; import org.springframework.amqp.core.AmqpTemplate; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.AnnotationConfigApplicationContext; public class Producer { public static void main(String[] args) { ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class); AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); String s = "A"; for(int i=0;i<28;++i){ s = s + s; System.o...