rabbitmq-c 安全漏洞 (CVE-2023-35789)

admin

0
文章

0
评论

2023-11-29 23:02:38 Ali_nvd 来源：ZONE.CI 全球网 0 阅读模式

中危 rabbitmq-c 安全漏洞 (CVE-2023-35789)

CVE编号

CVE-2023-35789

利用情况

暂无

补丁情况

官方补丁

披露时间

2023-06-17

漏洞描述

An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/alanxz/rabbitmq-c/issues/575
https://github.com/alanxz/rabbitmq-c/pull/781

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	rabbitmq-c_project	rabbitmq-c	*		Up to (including) 0.13.0
	运行在以下环境
	系统	debian_10	librabbitmq	*		Up to (including) 0.9.0-0.2
	运行在以下环境
	系统	debian_11	librabbitmq	*		Up to (including) 0.10.0-1
	运行在以下环境
	系统	debian_12	librabbitmq	*		Up to (including) 0.11.0-1
	运行在以下环境
	系统	debian_sid	librabbitmq	*		Up to (including) 0.11.0-1
	运行在以下环境
	系统	kylinos_aarch64_V10	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10HPC	librabbitmq	*		Up to (excluding) 0.9.0-9.ky10h
	运行在以下环境
	系统	kylinos_aarch64_V10SP1	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP2	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP3	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP3	librabbitmq	*		Up to (excluding) 0.9.0-5.a.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10HPC	librabbitmq	*		Up to (excluding) 0.9.0-9.ky10h
	运行在以下环境
	系统	kylinos_x86_64_V10SP1	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP2	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP3	librabbitmq	*		Up to (excluding) 0.9.0-5.ky10
	运行在以下环境
	系统	unionos_e	librabbitmq	*		Up to (excluding) librabbitmq-0.9.0-7.uel20