CVE-2019-11287
RabbitMQ Web Management Plugin DoS via heap overflow
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
RabbitMQ Web Management Plugin DoS via heap overflow
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
CVE-2019-11287- CVSS 3.0
- 4.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-4206
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
EUVD-2022-4206- CVSS 3.0
- 4.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrfh-7j5f-8ccr
Pivotal RabbitMQ is vulnerable to a denial of service attack
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
GHSA-hrfh-7j5f-8ccr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-134, CWE-400
- Updated
- 2026-11-02
NVD
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
CVE-2019-11287- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 4.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-134
- Updated
- 2026-11-02
OSV
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
CVE-2019-11287- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-11287
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
DEBIAN-CVE-2019-11287- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-hrfh-7j5f-8ccr
Pivotal RabbitMQ is vulnerable to a denial of service attack
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
GHSA-hrfh-7j5f-8ccr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-134, CWE-400
- Updated
- 2026-11-02
OSVRHSA-2020:0078
Red Hat Security Advisory: rabbitmq-server security update
- Record
RHSA-2020:0078- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-11287
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
- Record
UBUNTU-CVE-2019-11287- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 4.5 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2022:3338-1 No score
Security update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma
This update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma fixes the following issues:
Security updates included on this update:
ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, rabbitmq-server:
- CVE-2020-1734: Fixed vulnerability where shell was enabled by default in a pipe lookup plugin subprocess. (SOC-11662, bnc#1164139)
- CVE-2021-44716: Fixed uncontrolled memory consumption in go's net/http. (bsc#1193597)
- CVE-2019-11287: Fixed DoS via 'X-Reason' HTTP Header in malicious Erlang format string. (bsc#1157665)
grafana:
- CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454).
- CVE-2021-44716: Fixed uncontrolled memory consumption in go's net/http (bsc#1193597).
python-Django:
- CVE-2022-28346: Fixed vulnerability that could lead to SQL injection in QuerySet.annotate(),aggregate() and extra(). (bsc#1198398)
- CVE-2022-34265: Fixed vulnerability that could lead to SQL injection via Trunc(kind) and Extract(lookup_name) arguments. (bsc#1201186)
rubygem puma:
- CVE-2022-24790: Fixed HTTP request smuggling vulnerability. (bsc#1197818)
Additional information about the this update:
Changes in ardana-ansible:
- Update to version 8.0+git.1660773729.3789a6d:
- Mitigate CVE-2020-1734 (SOC-11662)
Changes in ardana-cobbler:
- Update to version 8.0+git.1660773402.d845a45:
- Mitigate CVE-2020-1734 (SOC-11662)
Changes in grafana:
-
Add CVE-2021-39226 patch (bsc#1191454, CVE-2021-39226)
- snapshot authentication bypass
-
Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)
- Fix Go net/http: limit growth of header canonicalization cache.
Changes in openstack-heat-templates:
- Update to version 0.0.0+git.1654529662.75fa04a:
- doc: Comment out language option
Changes in openstack-murano:
- Update to version murano-4.0.2.dev3:
- [stable-only] Remove periodic-stable-jobs template
Changes in openstack-murano:
- Update to version murano-4.0.2.dev3:
- [stable-only] Remove periodic-stable-jobs template
Changes in rabbitmq-server:
- add explanation-format patch to fix CVE-2019-11287 (bsc#1157665)
Changes in python-Django:
-
Rename Django-1.11.29.tar.gz.asc to Django-1.11.29.tar.gz.checksums.txt to avoid source_validator incorrectly trying to use it as a detached signature file for the sources tarball.
-
Remove unnecessary project.diff file.
-
Add CVE-2022-28346 patch (bsc#1198398, CVE-2022-28346)
- Potential SQL injection in QuerySet.annotate(),aggregate() and extra()
-
Add CVE-2022-34265 patch (bsc#1201186, CVE-2022-34265)
- SQL injection via Trunc(kind) and Extract(lookup_name) arguments
Changes in rubygem-puma:
- Add CVE-2022-24790: Fixed HTTP request smuggling vulnerability (bsc#1197818).
- Record
SUSE-SU-2022:3338-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3339-1 No score
Security update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma
This update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma fixes the following issues:
Security fixes included in this update:
ardana-ansible:
- CVE-2020-1734: Fixed vulnerability where shell was enabled by default in a pipe lookup plugin subprocess (SOC-11662, bnc#1164139). grafana:
- CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454). rabbitmq-server:
- CVE-2019-11287: Fixed DoS via 'X-Reason' HTTP Header in malicious Erlang format string (bsc#1157665). rubygem-puma:
- CVE-2022-24790: Fixed HTTP request smuggling (bsc#1197818). python-Django1:
- CVE-2022-28346: Fixed vulnerability allowing SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398).
- CVE-2022-34265: Fixed vulnerability allowing SQL injection via Trunc(kind) and Extract(lookup_name) arguments (bsc#1201186). Bugfixes:
- Disabled two barbican tests (SOC-8764).
Non-security fixes included on this update:
Changes in ardana-ansible:
- Update to version 9.0+git.1660748476.c118d23:
- Mitigate CVE-2020-1734 (SOC-11662)
Changes in ardana-cobbler:
- Update to version 9.0+git.1660747489.119efcd:
- Mitigate CVE-2020-1734 (SOC-11662)
Changes in ardana-tempest:
- Update to version 9.0+git.1651855288.a2341ad:
- Disable two barbican tests (SOC-8764)
Changes in grafana:
- Add CVE-2021-39226 patch (bsc#1191454, CVE-2021-39226)
- snapshot authentication bypass
Changes in openstack-heat-templates:
- Update to version 0.0.0+git.1654529662.75fa04a7:
- doc: Comment out language option
Changes in openstack-horizon-plugin-gbp-ui:
- Update to version group-based-policy-ui-14.0.1.dev4:
- remove legacy servicechain code
Changes in openstack-neutron-gbp:
-
Update to version group-based-policy-14.0.1.dev46:
- Remove logs 2014.2.rc1
-
Update to version group-based-policy-14.0.1.dev45:
- FIP Status active after dissociate
-
Update to version group-based-policy-14.0.1.dev43:
- fixed apic synchronization state for multiple erspan session
-
Update to version group-based-policy-14.0.1.dev41:
- Remove_legacy_service_chain_code(2)
-
Update to version group-based-policy-14.0.1.dev39:
- data-migrations spelling fixes 2014.2rc1
-
Update to version group-based-policy-14.0.1.dev38:
- Adding support for address group feature in upstream
-
Update to version group-based-policy-14.0.1.dev36:
- Add support for yoga 2014.2.rc1
-
Update to version group-based-policy-14.0.1.dev35:
- Removed_legacy_service_chain_code 2014.2rc1
Changes in openstack-nova:
- Update to version nova-18.3.1.dev92:
- [stable-only] Drop lower-constraints job
Changes in openstack-nova:
- Update to version nova-18.3.1.dev92:
- [stable-only] Drop lower-constraints job
Changes in python-Djanjo1:
-
Rename Django-1.11.29.tar.gz.asc to Django-1.11.29.tar.gz.checksums.txt to avoid source_validator incorrectly trying to use it as a detached signature file for the sources tarball.
-
Add CVE-2022-28346 patch (bsc#1198398, CVE-2022-28346)
- Potential SQL injection in QuerySet.annotate(),aggregate() and extra()
-
Add CVE-2022-34265 patch (bsc#1201186, CVE-2022-34265)
- SQL injection via Trunc(kind) and Extract(lookup_name) arguments
Changes in rabbitmq-server:
- add explanation-format patch to fix CVE-2019-11287 (bsc#1157665)
Changes in rubygem-puma:
- Add CVE-2022-24790 patch (bsc#1197818, CVE-2022-24790).
- Record
SUSE-SU-2022:3339-1- Updated
- 2026-11-02
OSVUSN-5004-1 No score
rabbitmq-server vulnerabilities
It was discovered that RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)
Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-22116)
- Record
USN-5004-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
RabbitMQHex |
3.7.0 up to 3.7.21 | 3.7.21 |
RabbitMQHex |
3.8.0 up to 3.8.1 | 3.8.1 |
RabbitMQHex |
before 1.16.7 | 1.16.7 |
RabbitMQHex |
1.17.0 up to 1.17.4 | 1.17.4 |
rabbitmq-serverDebian:12 |
before 3.8.3-1 | 3.8.3-1 |
rabbitmq-serverDebian:13 |
before 3.8.3-1 | 3.8.3-1 |
rabbitmq-serverDebian:14 |
before 3.8.3-1 | 3.8.3-1 |
rabbitmq-serverDebian:9 From an advisory covering 6 CVEs |
before 3.6.6-1+deb9u1, plus listed versions 3.6.6-1 |
3.6.6-1+deb9u1 |
rabbitmq-serverRed Hat:openstack:15::el8 From an advisory covering 2 CVEs |
before 0:3.7.22-1.el8ost | 0:3.7.22-1.el8ost |
ardana-ansibleSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 8.0+git.1660773729.3789a6d-3.85.1 | 8.0+git.1660773729.3789a6d-3.85.1 |
Show 55 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ardana-cobblerSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 8.0+git.1660773402.d845a45-3.47.1 | 8.0+git.1660773402.d845a45-3.47.1 |
grafanaSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 6.7.4-4.23.1 | 6.7.4-4.23.1 |
openstack-heat-templatesSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 0.0.0+git.1654529662.75fa04a-3.27.1 | 0.0.0+git.1654529662.75fa04a-3.27.1 |
openstack-muranoSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
openstack-murano-docSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
python-DjangoSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 1.11.29-3.42.1 | 1.11.29-3.42.1 |
rabbitmq-serverSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 3.6.16-3.13.1 | 3.6.16-3.13.1 |
venv-openstack-heatSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 9.0.8~dev22-12.45.1 | 9.0.8~dev22-12.45.1 |
venv-openstack-horizon-hpeSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 12.0.5~dev6-14.48.1 | 12.0.5~dev6-14.48.1 |
venv-openstack-muranoSUSE:HPE Helion OpenStack 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-12.38.1 | 4.0.2~dev3-12.38.1 |
ardana-ansibleSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 8.0+git.1660773729.3789a6d-3.85.1 | 8.0+git.1660773729.3789a6d-3.85.1 |
ardana-cobblerSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 8.0+git.1660773402.d845a45-3.47.1 | 8.0+git.1660773402.d845a45-3.47.1 |
grafanaSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 6.7.4-4.23.1 | 6.7.4-4.23.1 |
openstack-heat-templatesSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 0.0.0+git.1654529662.75fa04a-3.27.1 | 0.0.0+git.1654529662.75fa04a-3.27.1 |
openstack-muranoSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
openstack-murano-docSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
python-DjangoSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 1.11.29-3.42.1 | 1.11.29-3.42.1 |
rabbitmq-serverSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 3.6.16-3.13.1 | 3.6.16-3.13.1 |
venv-openstack-heatSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 9.0.8~dev22-12.45.1 | 9.0.8~dev22-12.45.1 |
venv-openstack-horizonSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 12.0.5~dev6-14.48.1 | 12.0.5~dev6-14.48.1 |
venv-openstack-muranoSUSE:OpenStack Cloud 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-12.38.1 | 4.0.2~dev3-12.38.1 |
grafanaSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 6.7.4-4.23.1 | 6.7.4-4.23.1 |
openstack-heat-templatesSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 0.0.0+git.1654529662.75fa04a-3.27.1 | 0.0.0+git.1654529662.75fa04a-3.27.1 |
openstack-muranoSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
openstack-murano-docSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 4.0.2~dev3-3.12.1 | 4.0.2~dev3-3.12.1 |
python-DjangoSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 1.11.29-3.42.1 | 1.11.29-3.42.1 |
rabbitmq-serverSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 3.6.16-3.13.1 | 3.6.16-3.13.1 |
rubygem-pumaSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 7 CVEs |
before 2.16.0-3.18.1 | 2.16.0-3.18.1 |
ardana-ansibleSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 9.0+git.1660748476.c118d23-3.32.1 | 9.0+git.1660748476.c118d23-3.32.1 |
ardana-cobblerSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 9.0+git.1660747489.119efcd-3.19.1 | 9.0+git.1660747489.119efcd-3.19.1 |
ardana-tempestSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 9.0+git.1651855288.a2341ad-3.22.1 | 9.0+git.1651855288.a2341ad-3.22.1 |
grafanaSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 6.7.4-3.29.1 | 6.7.4-3.29.1 |
openstack-heat-templatesSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 0.0.0+git.1654529662.75fa04a7-3.15.1 | 0.0.0+git.1654529662.75fa04a7-3.15.1 |
openstack-horizon-plugin-gbp-uiSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 14.0.1~dev4-3.12.1 | 14.0.1~dev4-3.12.1 |
openstack-neutron-gbpSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 14.0.1~dev46-3.34.1 | 14.0.1~dev46-3.34.1 |
openstack-novaSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 18.3.1~dev92-3.43.1 | 18.3.1~dev92-3.43.1 |
python-Django1SUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 1.11.29-3.40.1 | 1.11.29-3.40.1 |
rabbitmq-serverSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 3.6.16-4.3.1 | 3.6.16-4.3.1 |
venv-openstack-heatSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 11.0.4~dev4-3.37.1 | 11.0.4~dev4-3.37.1 |
venv-openstack-horizonSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 14.1.1~dev11-4.41.1 | 14.1.1~dev11-4.41.1 |
venv-openstack-neutronSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 13.0.8~dev206-6.41.1 | 13.0.8~dev206-6.41.1 |
venv-openstack-novaSUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs |
before 18.3.1~dev92-3.41.1 | 18.3.1~dev92-3.41.1 |
grafanaSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 6.7.4-3.29.1 | 6.7.4-3.29.1 |
openstack-heat-templatesSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 0.0.0+git.1654529662.75fa04a7-3.15.1 | 0.0.0+git.1654529662.75fa04a7-3.15.1 |
openstack-horizon-plugin-gbp-uiSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 14.0.1~dev4-3.12.1 | 14.0.1~dev4-3.12.1 |
openstack-neutron-gbpSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 14.0.1~dev46-3.34.1 | 14.0.1~dev46-3.34.1 |
openstack-novaSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 18.3.1~dev92-3.43.1 | 18.3.1~dev92-3.43.1 |
python-Django1SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 1.11.29-3.40.1 | 1.11.29-3.40.1 |
rabbitmq-serverSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 3.6.16-4.3.1 | 3.6.16-4.3.1 |
rubygem-pumaSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs |
before 2.16.0-4.18.1 | 2.16.0-4.18.1 |
rabbitmq-serverUbuntu:Pro:16.04:LTS |
before 3.5.7-1ubuntu0.16.04.4+esm1, plus listed versions 3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.13.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.4 |
3.5.7-1ubuntu0.16.04.4+esm1 |
rabbitmq-serverUbuntu:18.04:LTS |
before 3.6.10-1ubuntu0.5, plus listed versions 3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.4 |
3.6.10-1ubuntu0.5 |
rabbitmq-serverUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 3.5.7-1ubuntu0.16.04.4+esm1, plus listed versions 3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.13.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.4 |
3.5.7-1ubuntu0.16.04.4+esm1 |
rabbitmq-serverUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 3.6.10-1ubuntu0.5, plus listed versions 3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.4 |
3.6.10-1ubuntu0.5 |
rabbitmq-serverUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 3.8.2-0ubuntu1.3, plus listed versions 3.7.8-4ubuntu23.7.18-13.8.2-0ubuntu13.8.2-0ubuntu1.13.8.2-0ubuntu1.2 |
3.8.2-0ubuntu1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mbadanoiu/CVE-2019-11287 | 2025-02-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11287 is a medium vulnerability (CVSS 4.5) in Pivotal Rabbitmq, published November 22, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.40%, the 91st percentile. Fixed in RabbitMQ 3.7.21.
References
pivotal.io/security/cve-2019-11287
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO
access.redhat.com/errata/RHSA-2020:0078
github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin
lists.debian.org/debian-lts-announce/2021/07/msg00011.html
Show 36 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-11287
security-tracker.debian.org/tracker/CVE-2019-11287
bugzilla.redhat.com/show_bug.cgi?id=1783318
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0078.json
cve.org/CVERecord?id=CVE-2019-11281
suse.com/support/update/announcement/2022/suse-su-20223338-1
bugzilla.suse.com/1157665
ubuntu.com/security/CVE-2019-11287