RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0217 advisory.

  - rabbitmq-server: DoS by publishing large messages over the HTTP API (CVE-2023-46118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4939-1 advisory.

  - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body     limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated     user with sufficient credentials can publish a very large messages over the HTTP API and cause target node     to be terminated by an out-of-memory killer-like mechanism. This vulnerability has been patched in     versions 3.11.24 and 3.12.7. (CVE-2023-46118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3687 advisory.

  - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body     limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated     user with sufficient credentials can publish a very large messages over the HTTP API and cause target node     to be terminated by an out-of-memory killer-like mechanism. This vulnerability has been patched in     versions 3.11.24 and 3.12.7. (CVE-2023-46118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5571 advisory.

  - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body     limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated     user with sufficient credentials can publish a very large messages over the HTTP API and cause target node     to be terminated by an out-of-memory killer-like mechanism. This vulnerability has been patched in     versions 3.11.24 and 3.12.7. (CVE-2023-46118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6501-1 advisory.

  - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body     limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated     user with sufficient credentials can publish a very large messages over the HTTP API and cause target node     to be terminated by an out-of-memory killer-like mechanism. This vulnerability has been patched in     versions 3.11.24 and 3.12.7. (CVE-2023-46118)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Identity Exposure running on the remote host is prior to 3.42.17. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-33 advisory.
Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components (RabbitMQ, libcurl, and nodeJS) were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Tenable Identity Exposure 3.42.17 updates RabbitMQ to version 3.12.6, libcurl to version 8.4.0 and nodeJS to version 18.18.0 to address the identified vulnerabilities. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189081	RHEL 9 : Red Hat OpenStack Platform 17.1 (rabbitmq-server) (RHSA-2024:0217)	Nessus	Red Hat Local Security Checks	medium
187148	SUSE SLES15 / openSUSE 15 Security Update : rabbitmq-server (SUSE-SU-2023:4939-1)	Nessus	SuSE Local Security Checks	medium
186866	Debian DLA-3687-1 : rabbitmq-server - LTS security update	Nessus	Debian Local Security Checks	medium
186517	Debian DSA-5571-1 : rabbitmq-server - security update	Nessus	Debian Local Security Checks	medium
186079	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : RabbitMQ vulnerability (USN-6501-1)	Nessus	Ubuntu Local Security Checks	medium
183963	Tenable Identity Exposure < 3.42.17 Multiple Vulnerabilities (TNS-2023-33)	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-46118

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical