GHSA-5xwg-cfvj-gff5

Dashboard / Vulnerabilities / GHSA-5xwg-cfvj-gff5

GHSA-5xwg-cfvj-gff5

Summary: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

Details: ## Summary The max body size was enforced to patch CVE-2023-46120, but even though that limit still works, the frame size itself still exceeds the given max size. ## Root cause The Java client records the AMQP 0-9-1 `frame_max` negotiated during connection tuning, but the socket inbound frame reader continues to validate broker-controlled payload lengths against the much larger `maxInboundMessageBodySize` limit. A broker peer can therefore send a method frame whose payload is larger than the negotiated `frame_max`, have it allocated and decoded, and complete the connection handshake instead of being rejected as a protocol violation. *Reported by Team Atlanta.*

References: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5xwg-cfvj-gff5, https://github.com/rabbitmq/rabbitmq-java-client/pull/1994, https://github.com/rabbitmq/rabbitmq-java-client/pull/1995, https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591, https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472, https://github.com/rabbitmq/rabbitmq-java-client, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0