RabbitMQ last vulnerabilities

[ophirzk]

Hi,

The last 2 security vulnerabilities: CVE-2021-22117 and CVE-2021-22116 have been solved in version 3.8.16 but it is not clear if they are relevant to RabbitMQ version prior to 3.8.x.
In CVE-2021-22117, "obsolete-default.x" is mentioned:

Do "obsolete-default.x" versions mean versions that are out of support (prior to 3.8.x)?

In CVE-2021-22116 there is no "obsolete-default.x", but it might be relevant to RabbitMQ 3.7/3.6 as well.
Is it relevant to 3.7.x/3.6.x as well?
I know that everyone should upgrade to the latest major version, but there are a lot of users who haven't (for their own reasons).

Links:
https://tanzu.vmware.com/security/cve-2021-22116
https://tanzu.vmware.com/security/cve-2021-22117

[michaelklishin]

Unless otherwise mentioned, a vulnerability is applicable to all earlier releases.

RabbitMQ 3.7 and 3.6 are both out of support (3.6 has been out of support for years) so
we did not try to reproduce with their final patches but I'm quite certain that all CVEs addressed since 3.8.14 are also present there.

[michaelklishin]

@ophirzk users of 3.6 and 3.7 should understand that those series will not get any more patches, even security patches, even for high severity vulnerabilities.

That said, RabbitMQ is open source software and all patches are publicly available. All three security patches after 3.8.14
are quite small so it should be possible to back port them
for those who absolutely cannot upgrade.

We are aware of one person who volunteered to try it for older Debian distributions. They contacted [email protected] and
asked how to identify the relevant changes (specific commits) and was given (I hope) enough information.

[ophirzk]

@michaelklishin
This it is a very valuable information.
Thank you.

[StayPirate]

That said, RabbitMQ is open source software and all patches are publicly available. All three security patches after 3.8.14
are quite small so it should be possible to back port them
for those who absolutely cannot upgrade.

Can you point me out which is the commit that mitigates CVE-2021-22116, I dove into these 36 commits between v3.8.15 and v3.8.16, and TBH I have not figured out where this patch is.

[StayPirate]

@michaelklishin ^