public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Peter Lemenkov <lemenkov@gmail.com>
To: git-commits@fedoraproject.org
Subject: [rpms/rabbitmq-server] f43: Fix CVEs
Date: Thu, 30 Jul 2026 15:09:57 GMT [thread overview]
Message-ID: <178542419731.1.10742566765749021891.rpms-rabbitmq-server-108bbf62423f@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/rabbitmq-server
Branch : f43
Commit : 108bbf62423f5af79ebae4f2c6c0b909fddcc60a
Author : Peter Lemenkov <lemenkov@gmail.com>
Date : 2026-07-30T16:45:51+02:00
Stats : +623/-1 in 13 file(s)
URL : https://src.fedoraproject.org/rpms/rabbitmq-server/c/108bbf62423f5af79ebae4f2c6c0b909fddcc60a?branch=f43
Log:
Fix CVEs
57212, 57213, 57215, 57217, 57219, 57221
Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
---
diff --git a/rabbitmq-server-0001-Use-default-EPMD-socket.patch b/rabbitmq-server-0001-Use-default-EPMD-socket.patch
index e1c0352..21962d8 100644
--- a/rabbitmq-server-0001-Use-default-EPMD-socket.patch
+++ b/rabbitmq-server-0001-Use-default-EPMD-socket.patch
@@ -1,3 +1,4 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Peter Lemenkov <lemenkov@gmail.com>
Date: Tue, 1 Sep 2020 12:29:25 +0200
Subject: [PATCH] Use default EPMD socket
diff --git a/rabbitmq-server-0002-Use-proto_dist-from-command-line.patch b/rabbitmq-server-0002-Use-proto_dist-from-command-line.patch
index b41b623..3b3c253 100644
--- a/rabbitmq-server-0002-Use-proto_dist-from-command-line.patch
+++ b/rabbitmq-server-0002-Use-proto_dist-from-command-line.patch
@@ -1,3 +1,4 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Peter Lemenkov <lemenkov@redhat.com>
Date: Fri, 15 Jul 2016 16:01:08 +0200
Subject: [PATCH] Use proto_dist from command line
diff --git a/rabbitmq-server-0003-force-python3.patch b/rabbitmq-server-0003-force-python3.patch
index dca1556..3688369 100644
--- a/rabbitmq-server-0003-force-python3.patch
+++ b/rabbitmq-server-0003-force-python3.patch
@@ -1,3 +1,4 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Lon Hohberger <lhh@redhat.com>
Date: Tue, 29 Jan 2019 11:36:11 -0500
Subject: [PATCH] force python3
diff --git a/rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch b/rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch
index 1fd32da..00ddf58 100644
--- a/rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch
+++ b/rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch
@@ -1,3 +1,4 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tuomo Soini <tis@foobar.fi>
Date: Wed, 21 Oct 2015 15:11:40 +0000
Subject: [PATCH] Greatly simplified wrapper script which works properly for
diff --git a/rabbitmq-server-0005-Allow-Elixir-1.19.patch b/rabbitmq-server-0005-Allow-Elixir-1.19.patch
index 01ca0be..02c513e 100644
--- a/rabbitmq-server-0005-Allow-Elixir-1.19.patch
+++ b/rabbitmq-server-0005-Allow-Elixir-1.19.patch
@@ -1,3 +1,4 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Michal Kuratczyk <michal.kuratczyk@broadcom.com>
Date: Thu, 6 Nov 2025 22:16:56 +0100
Subject: [PATCH] Allow Elixir 1.19
diff --git a/rabbitmq-server-0007-Federation-management-Use-fmt_string-1-in-one-more-p.patch b/rabbitmq-server-0007-Federation-management-Use-fmt_string-1-in-one-more-p.patch
new file mode 100644
index 0000000..18bfa5c
--- /dev/null
+++ b/rabbitmq-server-0007-Federation-management-Use-fmt_string-1-in-one-more-p.patch
@@ -0,0 +1,20 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Wed, 11 Mar 2026 14:29:26 -0700
+Subject: [PATCH] Federation management: Use fmt_string/1 in one more place
+
+(cherry picked from commit c2d0d69edf01efbd6e87dfb250c373a32da957f8)
+
+diff --git a/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs b/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
+index e47f697544..06e3f62643 100644
+--- a/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
++++ b/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
+@@ -82,7 +82,7 @@
+ </td>
+ <td><%= link.timestamp %></td>
+ <td><%= link.id %></td>
+- <td><%= link.consumer_tag %></td>
++ <td><%= fmt_string(link.consumer_tag) %></td>
+ <td>
+ <form action="#/federation-restart-link" method="delete" class="confirm">
+ <input type="hidden" name="id" value="<%= link.id %>"/>
diff --git a/rabbitmq-server-0008-Reject-bindings-to-Direct-Reply-to-virtual-queues.patch b/rabbitmq-server-0008-Reject-bindings-to-Direct-Reply-to-virtual-queues.patch
new file mode 100644
index 0000000..627abc8
--- /dev/null
+++ b/rabbitmq-server-0008-Reject-bindings-to-Direct-Reply-to-virtual-queues.patch
@@ -0,0 +1,81 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Sun, 5 Apr 2026 16:00:44 -0700
+Subject: [PATCH] Reject bindings to Direct Reply-to virtual "queues"
+
+(cherry picked from commit 9055500d10ca7629dd2b051c6dc7a4b0bb8f6734)
+(cherry picked from commit 7971061dba915cc67dcd11e7503395c1e68c2f9a)
+
+diff --git a/deps/rabbit/src/rabbit_amqp_session.erl b/deps/rabbit/src/rabbit_amqp_session.erl
+index 29d6b33401..5b8a4a65d5 100644
+--- a/deps/rabbit/src/rabbit_amqp_session.erl
++++ b/deps/rabbit/src/rabbit_amqp_session.erl
+@@ -2592,19 +2592,24 @@ ensure_source_v1(Address,
+ XNameBin = unicode:characters_to_binary(XNameList),
+ XName = exchange_resource(Vhost, XNameBin),
+ QName = queue_resource(Vhost, QNameBin),
+- Binding = #binding{source = XName,
+- destination = QName,
+- key = RoutingKey},
+- PermCache2 = check_resource_access(QName, write, User, PermCache1),
+- PermCache = check_resource_access(XName, read, User, PermCache2),
+- {ok, X} = rabbit_exchange:lookup(XName),
+- TopicPermCache = check_read_permitted_on_topic(
+- X, User, RoutingKey, TopicPermCache0),
+- case rabbit_binding:add(Binding, Username) of
+- ok ->
+- {ok, QName, PermCache, TopicPermCache};
+- {error, _} = Err ->
+- Err
++ case QNameBin of
++ <<"amq.rabbitmq.reply-to.", _/binary>> ->
++ {error, {volatile_queue_not_bindable, QNameBin}};
++ _ when is_binary (QNameBin) ->
++ Binding = #binding{source = XName,
++ destination = QName,
++ key = RoutingKey},
++ PermCache2 = check_resource_access(QName, write, User, PermCache1),
++ PermCache = check_resource_access(XName, read, User, PermCache2),
++ {ok, X} = rabbit_exchange:lookup(XName),
++ TopicPermCache = check_read_permitted_on_topic(
++ X, User, RoutingKey, TopicPermCache0),
++ case rabbit_binding:add(Binding, Username) of
++ ok ->
++ {ok, QName, PermCache, TopicPermCache};
++ {error, _} = Err ->
++ Err
++ end
+ end
+ end;
+ {error, _} = Err ->
+diff --git a/deps/rabbit/src/rabbit_channel.erl b/deps/rabbit/src/rabbit_channel.erl
+index d136c92db3..04ce3e5283 100644
+--- a/deps/rabbit/src/rabbit_channel.erl
++++ b/deps/rabbit/src/rabbit_channel.erl
+@@ -1062,6 +1062,18 @@ check_exchange_deletion(XName = #resource{name = <<"amq.", _/binary>>,
+ check_exchange_deletion(_) ->
+ ok.
+
++reject_volatile_queue_as_binding_target(queue, DestinationNameBin) ->
++ case DestinationNameBin of
++ <<"amq.rabbitmq.reply-to.", _/binary>> ->
++ rabbit_misc:protocol_error(
++ access_refused,
++ "cannot bind or unbind to a volatile (direct reply-to) queue", []);
++ _ when is_binary (DestinationNameBin) ->
++ ok
++ end;
++reject_volatile_queue_as_binding_target(_, _) ->
++ ok.
++
+ %% check that an exchange/queue name does not contain the reserved
+ %% "amq." prefix.
+ %%
+@@ -1794,6 +1806,7 @@ binding_action_with_checks(
+ #user{username = Username} = User) ->
+ ExchangeNameBin = strip_cr_lf(SourceNameBin0),
+ DestinationNameBin = strip_cr_lf(DestinationNameBin0),
++ reject_volatile_queue_as_binding_target(DestinationType, DestinationNameBin),
+ DestinationName = name_to_resource(DestinationType, DestinationNameBin, VHostPath),
+ check_write_permitted(DestinationName, User, AuthzContext),
+ ExchangeName = rabbit_misc:r(VHostPath, exchange, ExchangeNameBin),
diff --git a/rabbitmq-server-0009-Fix-error-popup-text-display.patch b/rabbitmq-server-0009-Fix-error-popup-text-display.patch
new file mode 100644
index 0000000..f6966e4
--- /dev/null
+++ b/rabbitmq-server-0009-Fix-error-popup-text-display.patch
@@ -0,0 +1,207 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Luke Bakken <lrbakken@amazon.com>
+Date: Wed, 23 Jul 2025 22:44:17 -0700
+Subject: [PATCH] Fix error popup text display
+
+When validation fails for a policy parameter, the resulting popup can't
+be read due to one extra binary encoding as well as code that escapes
+HTML entites. Since the EJS template uses `<%= >` for the popup, it will
+display the text as-is, and not render any HTML.
+
+diff --git a/deps/rabbit/src/rabbit_definitions.erl b/deps/rabbit/src/rabbit_definitions.erl
+index 0f69b3ddf4..3b052b0495 100644
+--- a/deps/rabbit/src/rabbit_definitions.erl
++++ b/deps/rabbit/src/rabbit_definitions.erl
+@@ -709,6 +709,8 @@ format({shutdown, _} = Error) ->
+ rabbit_log:debug("Metadata store is unavailable: ~p", [Error]),
+ rabbit_data_coercion:to_binary(
+ rabbit_misc:format("Metadata store is unavailable. Please try again.", []));
++format(E) when is_binary(E) ->
++ E;
+ format(E) ->
+ rabbit_data_coercion:to_binary(rabbit_misc:format("~tp", [E])).
+
+@@ -732,8 +734,8 @@ add_parameter(VHost, Param, Username) ->
+ case Result of
+ ok -> ok;
+ {error_string, E} ->
+- S = rabbit_misc:format(" (~ts/~ts/~ts)", [VHost, Comp, Key]),
+- exit(rabbit_data_coercion:to_binary(rabbit_misc:escape_html_tags(E ++ S)))
++ S = rabbit_misc:format(" (vhost: \"~ts\" / component: \"~ts\" / key: \"~ts\")", [VHost, Comp, Key]),
++ exit(rabbit_data_coercion:to_utf8_binary(E ++ S))
+ end.
+
+ add_global_parameter(Param, Username) ->
+@@ -769,8 +771,8 @@ add_policy(VHost, Param, Username) ->
+ maps:get('apply-to', Param, <<"all">>),
+ Username) of
+ ok -> ok;
+- {error_string, E} -> S = rabbit_misc:format(" (~ts/~ts)", [VHost, Key]),
+- exit(rabbit_data_coercion:to_binary(rabbit_misc:escape_html_tags(E ++ S)))
++ {error_string, E} -> S = rabbit_misc:format(" (vhost: \"~ts\" key: \"~ts\")", [VHost, Key]),
++ exit(rabbit_data_coercion:to_utf8_binary(E ++ S))
+ end.
+
+ -spec add_vhost(map(), rabbit_types:username()) -> ok | no_return().
+diff --git a/deps/rabbit_common/src/rabbit_misc.erl b/deps/rabbit_common/src/rabbit_misc.erl
+index 09ff33a8ca..a5408ceecb 100644
+--- a/deps/rabbit_common/src/rabbit_misc.erl
++++ b/deps/rabbit_common/src/rabbit_misc.erl
+@@ -68,7 +68,7 @@
+ -export([get_parent/0]).
+ -export([store_proc_name/1, store_proc_name/2, get_proc_name/0]).
+ -export([moving_average/4]).
+--export([escape_html_tags/1, b64decode_or_throw/1]).
++-export([b64decode_or_throw/1]).
+ -export([get_env/3]).
+ -export([get_channel_operation_timeout/0]).
+ -export([random/1]).
+@@ -1181,25 +1181,6 @@ moving_average(Time, HalfLife, Next, Current) ->
+ random(N) ->
+ rand:uniform(N).
+
+--spec escape_html_tags(string()) -> binary().
+-
+-escape_html_tags(S) ->
+- escape_html_tags(rabbit_data_coercion:to_list(S), []).
+-
+-
+--spec escape_html_tags(string(), string()) -> binary().
+-
+-escape_html_tags([], Acc) ->
+- rabbit_data_coercion:to_binary(lists:reverse(Acc));
+-escape_html_tags("<" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse("<", Acc));
+-escape_html_tags(">" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse(">", Acc));
+-escape_html_tags("&" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse("&", Acc));
+-escape_html_tags([C | Rest], Acc) ->
+- escape_html_tags(Rest, [C | Acc]).
+-
+ %% If the server we are talking to has non-standard net_ticktime, and
+ %% our connection lasts a while, we could get disconnected because of
+ %% a timeout unless we set our ticktime to be the same. So let's do
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+index 88946e6943..63fc68b7c8 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+@@ -876,8 +876,7 @@ with_vhost_and_props(Fun, ReqData, Context) ->
+ bad_request(Error, ReqData1, Context)
+ end;
+ {error, Reason} ->
+- bad_request(rabbit_mgmt_format:escape_html_tags(Reason),
+- ReqData1, Context)
++ bad_request(Reason, ReqData1, Context)
+ end
+ end.
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_healthchecks.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_healthchecks.erl
+index fe52f4a7aa..e9f46daed9 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_healthchecks.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_healthchecks.erl
+@@ -48,8 +48,7 @@ to_json(ReqData, Context) ->
+ {badrpc, Err} ->
+ failure(rabbit_mgmt_format:print("~tp", Err), ReqData, Context);
+ {error_string, Err} ->
+- S = rabbit_mgmt_format:escape_html_tags(
+- rabbit_data_coercion:to_list(rabbit_mgmt_format:print(Err))),
++ S = rabbit_mgmt_format:print(Err),
+ failure(S, ReqData, Context)
+ end.
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_parameter.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_parameter.erl
+index 3b277bef79..71ca1ba43b 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_parameter.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_parameter.erl
+@@ -61,10 +61,7 @@ accept_content(ReqData0, Context = #context{user = User}) ->
+ ok ->
+ {true, ReqData, Context};
+ {error_string, Reason} ->
+- S = rabbit_mgmt_format:escape_html_tags(
+- rabbit_data_coercion:to_list(Reason)),
+- rabbit_mgmt_util:bad_request(
+- rabbit_data_coercion:to_binary(S), ReqData, Context)
++ rabbit_mgmt_util:bad_request(Reason, ReqData, Context)
+ end
+ end)
+ end.
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_policy.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_policy.erl
+index a91e5b1a55..df1960c6de 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_policy.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_policy.erl
+@@ -60,8 +60,7 @@ accept_content(ReqData0, Context = #context{user = #user{username = Username}})
+ ok ->
+ {true, ReqData, Context};
+ {error_string, Reason} ->
+- rabbit_mgmt_util:bad_request(
+- rabbit_mgmt_format:escape_html_tags(Reason), ReqData, Context)
++ rabbit_mgmt_util:bad_request(Reason, ReqData, Context)
+ end
+ end)
+ end.
+diff --git a/deps/rabbitmq_management_agent/src/rabbit_mgmt_format.erl b/deps/rabbitmq_management_agent/src/rabbit_mgmt_format.erl
+index 9c5d4bd7bf..45960a19e9 100644
+--- a/deps/rabbitmq_management_agent/src/rabbit_mgmt_format.erl
++++ b/deps/rabbitmq_management_agent/src/rabbit_mgmt_format.erl
+@@ -15,7 +15,7 @@
+ -export([to_amqp_table/1, listener/1, web_context/1, properties/1, basic_properties/1]).
+ -export([record/2, to_basic_properties/1]).
+ -export([addr/1, port/1]).
+--export([format_nulls/1, escape_html_tags/1]).
++-export([format_nulls/1]).
+ -export([print/2, print/1]).
+
+ -export([format_queue_stats/1, format_queue_basic_stats/1,
+@@ -533,27 +533,6 @@ format_null_item([{_K, _V} | _T] = L) ->
+ format_null_item(Value) ->
+ Value.
+
+-
+--spec escape_html_tags(string()) -> binary().
+-
+-escape_html_tags(S) ->
+- escape_html_tags(rabbit_data_coercion:to_list(S), []).
+-
+-
+--spec escape_html_tags(string(), string()) -> binary().
+-
+-escape_html_tags([], Acc) ->
+- rabbit_data_coercion:to_binary(lists:reverse(Acc));
+-escape_html_tags("<" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse("<", Acc));
+-escape_html_tags(">" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse(">", Acc));
+-escape_html_tags("&" ++ Rest, Acc) ->
+- escape_html_tags(Rest, lists:reverse("&", Acc));
+-escape_html_tags([C | Rest], Acc) ->
+- escape_html_tags(Rest, [C | Acc]).
+-
+-
+ -spec clean_consumer_details(proplists:proplist()) -> proplists:proplist().
+ clean_consumer_details(Obj) ->
+ case pget(consumer_details, Obj) of
+diff --git a/deps/rabbitmq_web_dispatch/src/rabbit_web_dispatch_access_control.erl b/deps/rabbitmq_web_dispatch/src/rabbit_web_dispatch_access_control.erl
+index c4561c27d4..86c5d6550d 100644
+--- a/deps/rabbitmq_web_dispatch/src/rabbit_web_dispatch_access_control.erl
++++ b/deps/rabbitmq_web_dispatch/src/rabbit_web_dispatch_access_control.erl
+@@ -273,8 +273,8 @@ not_authorised(Reason, ReqData, Context) ->
+
+ halt_response(Code, Type, Reason, ReqData, Context) ->
+ ReasonFormatted = format_reason(Reason),
+- Json = #{<<"error">> => Type,
+- <<"reason">> => ReasonFormatted},
++ Json = #{error => Type,
++ reason => ReasonFormatted},
+ ReqData1 = cowboy_req:reply(Code,
+ #{<<"content-type">> => <<"application/json">>},
+ rabbit_json:encode(Json), ReqData),
+@@ -286,7 +286,7 @@ not_authenticated(Reason, ReqData, Context, _AuthConfig) ->
+ format_reason(Tuple) when is_tuple(Tuple) ->
+ tuple(Tuple);
+ format_reason(Binary) when is_binary(Binary) ->
+- Binary;
++ unicode:characters_to_binary(Binary);
+ format_reason(Other) ->
+ case is_string(Other) of
+ true -> print("~ts", [Other]);
diff --git a/rabbitmq-server-0010-HTTP-API-refactor-read_complete_body-1.patch b/rabbitmq-server-0010-HTTP-API-refactor-read_complete_body-1.patch
new file mode 100644
index 0000000..9c15a02
--- /dev/null
+++ b/rabbitmq-server-0010-HTTP-API-refactor-read_complete_body-1.patch
@@ -0,0 +1,87 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Wed, 11 Mar 2026 16:26:14 -0700
+Subject: [PATCH] HTTP API: refactor `read_complete_body/1`
+
+(cherry picked from commit b8fc2ef7c50a2797d15e1ea7cf34f290032303bb)
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+index 63fc68b7c8..467e1b1c4a 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+@@ -723,8 +723,22 @@ read_complete_body(Req0, Acc, BodySizeLimit) ->
+ {error, http_body_limit_exceeded, BodySizeLimit, N};
+ false ->
+ case cowboy_req:read_body(Req0) of
+- {ok, Data, Req} -> {ok, <<Acc/binary, Data/binary>>, Req};
+- {more, Data, Req} -> read_complete_body(Req, <<Acc/binary, Data/binary>>)
++ {ok, Data, Req} ->
++ Total = <<Acc/binary, Data/binary>>,
++ case byte_size(Total) > BodySizeLimit of
++ true ->
++ {error, http_body_limit_exceeded, BodySizeLimit, byte_size(Total)};
++ false ->
++ {ok, Total, Req}
++ end;
++ {more, Data, Req} ->
++ Total = <<Acc/binary, Data/binary>>,
++ case byte_size(Total) > BodySizeLimit of
++ true ->
++ {error, http_body_limit_exceeded, BodySizeLimit, byte_size(Total)};
++ false ->
++ read_complete_body(Req, Total, BodySizeLimit)
++ end
+ end
+ end.
+
+@@ -748,8 +762,16 @@ do_read_complete_body_with_limit(Req0, Acc, BodySizeLimit) ->
+ {error, http_body_limit_exceeded, BodySizeLimit, N};
+ false ->
+ case cowboy_req:read_body(Req0, #{length => BodySizeLimit, period => 30000}) of
+- {ok, Data, Req} -> {ok, <<Acc/binary, Data/binary>>, Req};
+- {more, Data, Req} -> do_read_complete_body_with_limit(Req, <<Acc/binary, Data/binary>>, BodySizeLimit)
++ {ok, Data, Req} ->
++ Total = <<Acc/binary, Data/binary>>,
++ case byte_size(Total) > BodySizeLimit of
++ true ->
++ {error, http_body_limit_exceeded, BodySizeLimit, byte_size(Total)};
++ false ->
++ {ok, Total, Req}
++ end;
++ {more, Data, Req} ->
++ do_read_complete_body_with_limit(Req, <<Acc/binary, Data/binary>>, BodySizeLimit)
+ end
+ end.
+
+@@ -867,16 +889,21 @@ with_vhost_and_props(Fun, ReqData, Context) ->
+ not_found(rabbit_data_coercion:to_binary("vhost_not_found"),
+ ReqData, Context);
+ VHost ->
+- {ok, Body, ReqData1} = read_complete_body(ReqData),
+- case decode(Body) of
+- {ok, Props} ->
+- try
+- Fun(VHost, Props, ReqData1)
+- catch {error, Error} ->
+- bad_request(Error, ReqData1, Context)
+- end;
+- {error, Reason} ->
+- bad_request(Reason, ReqData1, Context)
++ case read_complete_body(ReqData) of
++ {error, http_body_limit_exceeded, LimitApplied, BytesRead} ->
++ rabbit_log:warning("HTTP API: request exceeded maximum allowed payload size (limit: ~tp bytes, payload size: ~tp bytes)", [LimitApplied, BytesRead]),
++ bad_request("Exceeded HTTP request body size limit", ReqData, Context);
++ {ok, Body, ReqData1} ->
++ case decode(Body) of
++ {ok, Props} ->
++ try
++ Fun(VHost, Props, ReqData1)
++ catch {error, Error} ->
++ bad_request(Error, ReqData1, Context)
++ end;
++ {error, Reason} ->
++ bad_request(Reason, ReqData1, Context)
++ end
+ end
+ end.
+
diff --git a/rabbitmq-server-0011-Remove-deprecated-endpoint.patch b/rabbitmq-server-0011-Remove-deprecated-endpoint.patch
new file mode 100644
index 0000000..d7ef969
--- /dev/null
+++ b/rabbitmq-server-0011-Remove-deprecated-endpoint.patch
@@ -0,0 +1,84 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marcial Rosales <marcial.rosales@broadcom.com>
+Date: Tue, 14 Apr 2026 18:16:15 +0200
+Subject: [PATCH] Remove deprecated endpoint
+
+This api/auth endpoint is not used since
+bootstrap.js endpoint was introduced back in 2023.
+
+diff --git a/deps/rabbitmq_management/priv/www/api/index.html b/deps/rabbitmq_management/priv/www/api/index.html
+index 27c6e1ea59..1654081cb8 100644
+--- a/deps/rabbitmq_management/priv/www/api/index.html
++++ b/deps/rabbitmq_management/priv/www/api/index.html
+@@ -1275,17 +1275,6 @@ or:
+ </p>
+ </td>
+ </tr>
+- <tr>
+- <td>X</td>
+- <td></td>
+- <td></td>
+- <td></td>
+- <td class="path">/api/auth</td>
+- <td>
+- Details about the OAuth2 configuration. It will return HTTP
+- status 200 with body: <pre>{"oauth_enabled":"boolean", "oauth_client_id":"string", "oauth_provider_url":"string"}</pre>
+- </td>
+- </tr>
+ <tr>
+ <td></td>
+ <td></td>
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl b/deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl
+index 06e2756739..fb7bfa6eca 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl
+@@ -205,7 +205,6 @@ dispatcher() ->
+ {"/reset", rabbit_mgmt_wm_reset, []},
+ {"/reset/:node", rabbit_mgmt_wm_reset, []},
+ {"/rebalance/queues", rabbit_mgmt_wm_rebalance_queues, [{queues, all}]},
+- {"/auth", rabbit_mgmt_wm_auth, []},
+ {"/auth/attempts/:node", rabbit_mgmt_wm_auth_attempts, [all]},
+ {"/auth/attempts/:node/source", rabbit_mgmt_wm_auth_attempts, [by_source]},
+ {"/login", rabbit_mgmt_wm_login, []},
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
+index 3e5a078dca..5e54ae381e 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
+@@ -7,8 +7,6 @@
+
+ -module(rabbit_mgmt_wm_auth).
+
+--export([init/2, to_json/2, content_types_provided/2, is_authorized/2]).
+--export([variances/2]).
+ -export([authSettings/0]). %% for testing only
+
+ -include_lib("rabbitmq_management_agent/include/rabbit_mgmt_records.hrl").
+@@ -16,15 +14,6 @@
+
+ %%--------------------------------------------------------------------
+
+-init(Req, _State) ->
+- {cowboy_rest, rabbit_mgmt_headers:set_common_permission_headers(Req, ?MODULE), #context{}}.
+-
+-variances(Req, Context) ->
+- {[<<"accept-encoding">>, <<"origin">>], Req, Context}.
+-
+-content_types_provided(ReqData, Context) ->
+- {rabbit_mgmt_util:responder_map(to_json), ReqData, Context}.
+-
+ merge_oauth_provider_info(OAuthResourceServer, MgtResourceServer, ManagementProps) ->
+ OAuthProviderResult = case proplists:get_value(oauth_provider_id, OAuthResourceServer) of
+ undefined -> oauth2_client:get_oauth_provider([issuer]);
+@@ -143,12 +132,6 @@ filter_empty_properties(ListOfProperties) ->
+
+ to_binary(Value) -> rabbit_data_coercion:to_binary(Value).
+
+-to_json(ReqData, Context) ->
+- rabbit_mgmt_util:reply(authSettings(), ReqData, Context).
+-
+-is_authorized(ReqData, Context) ->
+- {true, ReqData, Context}.
+-
+ is_invalid(List) ->
+ lists:any(fun(V) -> case V of
+ "" -> true;
diff --git a/rabbitmq-server-0012-Remove-deprecated-endpoint.patch b/rabbitmq-server-0012-Remove-deprecated-endpoint.patch
new file mode 100644
index 0000000..0d22da9
--- /dev/null
+++ b/rabbitmq-server-0012-Remove-deprecated-endpoint.patch
@@ -0,0 +1,68 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marcial Rosales <marcial.rosales@broadcom.com>
+Date: Tue, 14 Apr 2026 18:16:15 +0200
+Subject: [PATCH] Remove deprecated endpoint
+
+This api/auth endpoint is not used since
+bootstrap.js endpoint was introduced back in 2023.
+
+(cherry picked from commit aa387c4451e7b674df3e3ba89df86a99d697cc7f)
+(cherry picked from commit 0d77d6eb518a5bb2fab253f4e377c2dbd6719063)
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
+index 5e54ae381e..6603f1abf7 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl
+@@ -14,21 +14,37 @@
+
+ %%--------------------------------------------------------------------
+
+-merge_oauth_provider_info(OAuthResourceServer, MgtResourceServer, ManagementProps) ->
+- OAuthProviderResult = case proplists:get_value(oauth_provider_id, OAuthResourceServer) of
+- undefined -> oauth2_client:get_oauth_provider([issuer]);
+- OauthProviderId -> oauth2_client:get_oauth_provider(OauthProviderId, [issuer])
+- end,
+- OAuthProviderInfo0 = case OAuthProviderResult of
+- {ok, OAuthProvider} -> oauth_provider_to_map(OAuthProvider);
+- {error, _} -> #{}
+- end,
+- OAuthProviderInfo1 = maps:merge(OAuthProviderInfo0,
+- case proplists:get_value(oauth_provider_url, ManagementProps) of
+- undefined -> #{};
+- V1 -> #{oauth_provider_url => V1}
+- end),
+- maps:merge(OAuthProviderInfo1, proplists:to_map(MgtResourceServer)).
++merge_property(Key, List, MapIn) ->
++ case proplists:get_value(Key, List) of
++ undefined -> MapIn;
++ V0 -> MapIn#{Key => V0}
++ end.
++
++extract_oauth_provider_info_props_as_map(ManagementProps) ->
++ lists:foldl(fun(K, Acc) ->
++ merge_property(K, ManagementProps, Acc) end, #{},
++ [oauth_provider_url,
++ oauth_metadata_url,
++ oauth_authorization_endpoint_params,
++ oauth_token_endpoint_params]).
++
++merge_oauth_provider_info(OAuthResourceServer, MgtResourceServer,
++ ManagementProps) ->
++ OAuthProviderResult =
++ case proplists:get_value(oauth_provider_id, OAuthResourceServer) of
++ undefined ->
++ oauth2_client:get_oauth_provider([issuer]);
++ OauthProviderId ->
++ oauth2_client:get_oauth_provider(OauthProviderId, [issuer])
++ end,
++ OAuthProviderInfo0 =
++ case OAuthProviderResult of
++ {ok, OAuthProvider} -> oauth_provider_to_map(OAuthProvider);
++ {error, _} -> #{}
++ end,
++ OAuthProviderInfo1 = maps:merge(OAuthProviderInfo0,
++ extract_oauth_provider_info_props_as_map(ManagementProps)),
++ maps:merge(OAuthProviderInfo1, proplists:to_map(MgtResourceServer)).
+
+ oauth_provider_to_map(OAuthProvider) ->
+ % only include issuer and end_session_endpoint for now. The other endpoints are resolved by oidc-client library
diff --git a/rabbitmq-server-0013-AMQP-0-9-1-apply-configure-checks-to-passive-queue-e.patch b/rabbitmq-server-0013-AMQP-0-9-1-apply-configure-checks-to-passive-queue-e.patch
new file mode 100644
index 0000000..3849056
--- /dev/null
+++ b/rabbitmq-server-0013-AMQP-0-9-1-apply-configure-checks-to-passive-queue-e.patch
@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Tue, 14 Apr 2026 11:36:04 -0700
+Subject: [PATCH] AMQP 0-9-1: apply `configure` checks to passive queue,
+ exchange declaration
+
+Just like we do for regular declarations.
+
+(cherry picked from commit 709a14e49e06c138a8cd672c9809ca34a2767962)
+(cherry picked from commit 72523af903702a710e3a922dd7b173df41e69c47)
+
+diff --git a/deps/rabbit/src/rabbit_amqp_management.erl b/deps/rabbit/src/rabbit_amqp_management.erl
+index bcc993b132..e60c967fe7 100644
+--- a/deps/rabbit/src/rabbit_amqp_management.erl
++++ b/deps/rabbit/src/rabbit_amqp_management.erl
+@@ -77,11 +77,13 @@ handle_http_req(<<"GET">>,
+ _Query,
+ null,
+ Vhost,
+- _User,
++ User,
+ _ConnPid,
+- PermCaches) ->
++ {PermCache0, TopicPermCache}) ->
+ QNameBin = rabbit_uri:urldecode(QNameBinQuoted),
+ QName = queue_resource(Vhost, QNameBin),
++ PermCache = check_resource_access(QName, configure, User, PermCache0),
++ PermCaches = {PermCache, TopicPermCache},
+ case rabbit_amqqueue:with(
+ QName,
+ fun(Q) ->
+diff --git a/deps/rabbit/src/rabbit_channel.erl b/deps/rabbit/src/rabbit_channel.erl
+index 04ce3e5283..74fa89e2fd 100644
+--- a/deps/rabbit/src/rabbit_channel.erl
++++ b/deps/rabbit/src/rabbit_channel.erl
+@@ -2509,9 +2509,10 @@ handle_method(#'queue.declare'{queue = QueueNameBin,
+ handle_method(#'queue.declare'{queue = QueueNameBin,
+ nowait = NoWait,
+ passive = true},
+- ConnPid, _AuthzContext, _CollectorPid, VHostPath, _User) ->
++ ConnPid, AuthzContext, _CollectorPid, VHostPath, User) ->
+ StrippedQueueNameBin = strip_cr_lf(QueueNameBin),
+ QueueName = rabbit_misc:r(VHostPath, queue, StrippedQueueNameBin),
++ check_configure_permitted(QueueName, User, AuthzContext),
+ Fun = fun (Q0) ->
+ QStat = maybe_stat(NoWait, Q0),
+ {QStat, Q0}
+@@ -2617,9 +2618,10 @@ handle_method(#'exchange.declare'{exchange = XNameBin,
+ AutoDelete, Internal, Args);
+ handle_method(#'exchange.declare'{exchange = ExchangeNameBin,
+ passive = true},
+- _ConnPid, _AuthzContext, _CollectorPid, VHostPath, _User) ->
++ _ConnPid, AuthzContext, _CollectorPid, VHostPath, User) ->
+ ExchangeName = rabbit_misc:r(VHostPath, exchange, strip_cr_lf(ExchangeNameBin)),
+ check_not_default_exchange(ExchangeName),
++ check_configure_permitted(ExchangeName, User, AuthzContext),
+ _ = rabbit_exchange:lookup_or_die(ExchangeName).
+
+ handle_deliver(CTag, Ack, Msgs, State) when is_list(Msgs) ->
diff --git a/rabbitmq-server.spec b/rabbitmq-server.spec
index 1d78241..b98fbb4 100644
--- a/rabbitmq-server.spec
+++ b/rabbitmq-server.spec
@@ -7,7 +7,7 @@
Name: rabbitmq-server
Version: 4.0.9
-Release: 4%{?dist}
+Release: 5%{?dist}
License: MPL-2.0
Source0: https://github.com/rabbitmq/rabbitmq-server/releases/download/v%{version}/%{name}_%{version}.orig.tar.xz
Source1: https://github.com/rabbitmq/rabbitmq-server/releases/download/v%{version}/%{name}_%{version}.orig.tar.xz.asc
@@ -23,6 +23,13 @@ Patch3: rabbitmq-server-0003-force-python3.patch
Patch4: rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch
Patch5: rabbitmq-server-0005-Allow-Elixir-1.19.patch
Patch6: rabbitmq-server-0006-management-Sanitize-vhost-names-in-restart-forms.patch
+Patch7: rabbitmq-server-0007-Federation-management-Use-fmt_string-1-in-one-more-p.patch
+Patch8: rabbitmq-server-0008-Reject-bindings-to-Direct-Reply-to-virtual-queues.patch
+Patch9: rabbitmq-server-0009-Fix-error-popup-text-display.patch
+Patch10: rabbitmq-server-0010-HTTP-API-refactor-read_complete_body-1.patch
+Patch11: rabbitmq-server-0011-Remove-deprecated-endpoint.patch
+Patch12: rabbitmq-server-0012-Remove-deprecated-endpoint.patch
+Patch13: rabbitmq-server-0013-AMQP-0-9-1-apply-configure-checks-to-passive-queue-e.patch
URL: https://www.rabbitmq.com/
BuildRequires: elixir
@@ -180,6 +187,10 @@ rm -f %{_rabbit_libdir}/lib/rabbitmq_server-%{version}/ebin/rabbit.{rel,script,b
%changelog
+* Thu Jul 30 2026 Peter Lemenkov <lemenkov@gmail.com> - 4.0.9-5
+- Fixed CVE-2026-57212, CVE-2026-57213, CVE-2026-57215, CVE-2026-57217,
+ CVE-2026-57219, CVE-2026-57221
+
* Thu Jul 23 2026 Peter Lemenkov <lemenkov@gmail.com> - 4.0.9-4
- Fixed CVE-2026-44839
reply other threads:[~2026-07-30 15:09 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178542419731.1.10742566765749021891.rpms-rabbitmq-server-108bbf62423f@fedoraproject.org \
--to=lemenkov@gmail.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox