| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| rabbitmq server | ≥ 3.13.0, < 3.13.15≥ 4.0.0, < 4.0.22≥ 4.1.0, < 4.1.11≥ 4.2.0, < 4.2.6≥ 4.3.0, < 4.3.1 | 3.13.154.0.224.1.114.2.64.3.1 |
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン