erlang-rabbitmq-client-3.5.4-1.4 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10370-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z erlang-rabbitmq-client-3.5.4-1.4 on GA media These are all security issues fixed in the erlang-rabbitmq-client-3.5.4-1.4 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10370 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2014-9494/ SUSE CVE CVE-2014-9494 page https://www.suse.com/security/cve/CVE-2015-0862/ SUSE CVE CVE-2015-0862 page openSUSE Tumbleweed erlang-rabbitmq-client-3.5.4-1.4 rabbitmq-server-3.5.4-1.4 rabbitmq-server-plugins-3.5.4-1.4 erlang-rabbitmq-client-3.5.4-1.4 as a component of openSUSE Tumbleweed rabbitmq-server-3.5.4-1.4 as a component of openSUSE Tumbleweed rabbitmq-server-plugins-3.5.4-1.4 as a component of openSUSE Tumbleweed RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header. CVE-2014-9494 openSUSE Tumbleweed:erlang-rabbitmq-client-3.5.4-1.4 openSUSE Tumbleweed:rabbitmq-server-3.5.4-1.4 openSUSE Tumbleweed:rabbitmq-server-plugins-3.5.4-1.4 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-9494.html CVE-2014-9494 https://bugzilla.suse.com/911857 SUSE Bug 911857 Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content. CVE-2015-0862 openSUSE Tumbleweed:erlang-rabbitmq-client-3.5.4-1.4 openSUSE Tumbleweed:rabbitmq-server-3.5.4-1.4 openSUSE Tumbleweed:rabbitmq-server-plugins-3.5.4-1.4 moderate 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-0862.html CVE-2015-0862