CVE-2023-46120

Name	CVE-2023-46120
Description	The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150002

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rabbitmq-java-client (PTS)	bookworm, trixie	5.0.0-1.1	vulnerable
	sid	5.0.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rabbitmq-java-client	source	(unstable)	(unfixed)			1150002

Notes

https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
Fixed by: https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8 (v5.18.0)