Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-57219 →
DEBIAN-CVE-2026-57219
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
rabbitmq-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
rabbitmq-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
rabbitmq-server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2"}]}]
Références
- advisory security-tracker.debian.org