Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2015-0862

Published: 18 January 2015

Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content.

Priority

Negligible

Status

Package Release Status
rabbitmq-server
Launchpad, Ubuntu, Debian 		artful Not vulnerable
(3.6.6-1)
bionic Not vulnerable
(3.6.6-1)
cosmic Not vulnerable
(3.6.6-1)
disco Not vulnerable
(3.6.6-1)
lucid Ignored
(end of life)
precise Ignored
(end of life)
trusty Does not exist
(trusty was needed)
upstream
Released (3.4.3)
utopic Ignored
(end of life)
vivid Ignored
(end of life)
wily Ignored
(end of life)
xenial Not vulnerable
(3.5.7-1)
yakkety Not vulnerable
(3.5.7-1)
zesty Not vulnerable
(3.6.6-1)
Patches:
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/ebc74bce55673498cf084e97df8155cfc5f3e622
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/9ac4122b227d858e4fb46a440a86a70b17e98735
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/fc16e72cb4ea051d117b01e7aa31fa03f02707fc
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/27c579fc419708a5daaf8440c042f56e37b0deed
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/6ab5f6176843db3819d7020e7c6ae76751d8db5a
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/80dae93bc5eee585c1997b8600331e89106a79c9
upstream: https://github.com/rabbitmq/rabbitmq-management/commit/89cd1e23e1ed84368d7c79a089799a8bcf735b86

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading