Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-77405 →
DEBIAN-CVE-2026-77405
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
golang-github-rabbitmq-amqp091-go
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
golang-github-rabbitmq-amqp091-go
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
golang-github-rabbitmq-amqp091-go
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1"}]}]
Références
- advisory security-tracker.debian.org