An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTIONSTATEHEADER. A rogue server could return a malicious frame header that leads to a smaller targetsize value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "amqp-tools", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "amqp-tools-dbgsym", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "librabbitmq-dbg", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "librabbitmq-dev", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "librabbitmq-dev-dbgsym", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "librabbitmq1", "binary_version": "0.4.1-1ubuntu0.1~esm1" }, { "binary_name": "librabbitmq1-dbgsym", "binary_version": "0.4.1-1ubuntu0.1~esm1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "amqp-tools", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "amqp-tools-dbgsym", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "librabbitmq-dbg", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "librabbitmq-dev", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "librabbitmq-dev-dbgsym", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "librabbitmq4", "binary_version": "0.7.1-1ubuntu0.2" }, { "binary_name": "librabbitmq4-dbgsym", "binary_version": "0.7.1-1ubuntu0.2" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "amqp-tools", "binary_version": "0.8.0-1ubuntu0.18.04.2" }, { "binary_name": "librabbitmq-dbg", "binary_version": "0.8.0-1ubuntu0.18.04.2" }, { "binary_name": "librabbitmq-dev", "binary_version": "0.8.0-1ubuntu0.18.04.2" }, { "binary_name": "librabbitmq4", "binary_version": "0.8.0-1ubuntu0.18.04.2" } ] }