diff -pruN 4.0.5-8/debian/changelog 4.0.5-8ubuntu2/debian/changelog --- 4.0.5-8/debian/changelog 2025-08-11 12:31:10.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/changelog 2025-09-19 15:36:28.000000000 +0000 @@ -1,3 +1,29 @@ +rabbitmq-server (4.0.5-8ubuntu2) questing; urgency=medium + + * SECURITY UPDATE: authorization headers logged in plaintext (in base64) + - debian/patches/CVE-2025-50200.patch: fix the exception logged by + Cowboy caused by double reply in src/rabbit_mgmt_util.erl, + src/rabbit_mgmt_wm_exchange_publish.erl, + src/rabbit_mgmt_wm_queue_actions.erl, + src/rabbit_mgmt_wm_queue_get.erl. + - CVE-2025-50200 + + -- Marc Deslauriers Fri, 19 Sep 2025 11:36:28 -0400 + +rabbitmq-server (4.0.5-8ubuntu1) questing; urgency=medium + + * Merge with Debian unstable (LP: #2120563). Remaining changes: + - d/rules: Enable rabbitmq-streams entrypoint. + - d/p/rabbitmq-dist.mk.patch: Drop, no longer needed. + * Dropped: + - Added new dep8 tests (LP #1679386) + [In 4.0.5-7] + - d/rules: Set PROJECT_VERSION to fix internal module versioning + issues. + [In 4.0.5-8] + + -- Andreas Hasenack Wed, 13 Aug 2025 11:00:09 -0300 + rabbitmq-server (4.0.5-8) unstable; urgency=medium * Fix rabbitmq-server broken plugin versions by applying patch from the BTS. @@ -13,6 +39,28 @@ rabbitmq-server (4.0.5-7) unstable; urge -- Thomas Goirand Mon, 30 Jun 2025 11:27:51 +0200 +rabbitmq-server (4.0.5-6ubuntu1) questing; urgency=medium + + * Merge with Debian unstable (LP: #2110429). Remaining changes: + - Added new dep8 tests (LP #1679386): + + d/t/hello-world + + d/t/publish-subscribe + + d/t/rpc + + d/t/work-queue + + d/t/smoke-test: remove unnecessary redirection and shell set + - d/rules: Set PROJECT_VERSION to fix internal module versioning + issues. + - d/rules: Enable rabbitmq-streams entrypoint. + - d/p/rabbitmq-dist.mk.patch: Drop, no longer needed. + * Dropped: + - d/rules: remove commented commands + [Previously undocumented. No need to add delta for this] + - d/p/elixir-1.18-compat.patch: Compatibility patch for conflict with + JSON module in newer Elixir versions (LP #2097790). + [In 4.0.5-6] + + -- Andreas Hasenack Thu, 26 Jun 2025 21:01:32 -0300 + rabbitmq-server (4.0.5-6) unstable; urgency=medium * Add elixir-1.18-compat.patch to fix json output of rabbitmctl @@ -39,6 +87,30 @@ rabbitmq-server (4.0.5-3) unstable; urge -- Thomas Goirand Mon, 10 Mar 2025 17:04:30 +0100 +rabbitmq-server (4.0.5-2ubuntu2) plucky; urgency=medium + + * d/rules: Set PROJECT_VERSION to fix internal module versioning + issues. + * d/rules: Enable rabbitmq-streams entrypoint. + * d/p/elixir-1.18-compat.patch: Compatibility patch for conflict with + JSON module in newer Elixir versions (LP: #2097790). + * d/p/rabbitmq-dist.mk.patch: Drop, no longer needed. + * d/p/publish-subscribe: Check use of JSON formatter. + + -- James Page Thu, 06 Mar 2025 13:17:43 +0000 + +rabbitmq-server (4.0.5-2ubuntu1) plucky; urgency=medium + + * Merge from Debian Unstable. Remaining changes: + - Added new dep8 tests (LP: #1679386): + + d/t/hello-world + + d/t/publish-subscribe + + d/t/rpc + + d/t/work-queue + + d/t/smoke-test: remove unnecessary redirection and shell set + + -- Simon Quigley Fri, 31 Jan 2025 11:04:06 -0600 + rabbitmq-server (4.0.5-2) unstable; urgency=medium * Works with Erlang 27 (Closes: #1090027). @@ -59,6 +131,32 @@ rabbitmq-server (4.0.5-1) unstable; urge -- Thomas Goirand Tue, 17 Dec 2024 10:23:14 +0100 +rabbitmq-server (3.12.1-1ubuntu2) oracular; urgency=medium + + * Added new dep8 tests (LP: #1679386): + - d/t/hello-world + - d/t/publish-subscribe + - d/t/rpc + - d/t/work-queue + - d/t/smoke-test: remove unnecessary redirection and shell set + * d/watch: update to find upstream tarball, and verify its signature + * d/upstream/signing-key.asc: added, downloaded from + https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc + + -- Mitchell Dzurick Tue, 23 Jul 2024 11:43:35 -0700 + +rabbitmq-server (3.12.1-1ubuntu1) noble; urgency=medium + + * SECURITY UPDATE: Denial of service + - debian/patches/CVE-2023-46118-*.patch: Introduce HTTP request body limit + for definition uploads and Reduce default HTTP API request body size limit + to 10 MiB in deps/rabbitmq_management/Makefile, include/rabbit_mgmt.hrl, + priv/schema/rabbitmq_management.schema, src/rabbit_mgmt_util.erl, + src/rabbit_mgmt_wm_definitions.erl. + - CVE-2023-46118 + + -- Leonidas Da Silva Barbosa Wed, 22 Nov 2023 16:07:37 -0300 + rabbitmq-server (3.12.1-1) experimental; urgency=medium * New upstream release. @@ -864,3 +962,4 @@ rabbitmq-server (1.5.0-1) testing; urgen * First Debian upload, closes: #507902 -- John Leuner Wed, 17 Dec 2008 18:23:47 +0000 + diff -pruN 4.0.5-8/debian/control 4.0.5-8ubuntu2/debian/control --- 4.0.5-8/debian/control 2025-08-11 12:31:10.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/control 2025-08-13 14:00:09.000000000 +0000 @@ -1,7 +1,8 @@ Source: rabbitmq-server Section: net Priority: optional -Maintainer: Debian OpenStack +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian OpenStack Uploaders: James Page , Thomas Goirand , diff -pruN 4.0.5-8/debian/patches/CVE-2025-50200.patch 4.0.5-8ubuntu2/debian/patches/CVE-2025-50200.patch --- 4.0.5-8/debian/patches/CVE-2025-50200.patch 1970-01-01 00:00:00.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/patches/CVE-2025-50200.patch 2025-09-19 15:36:23.000000000 +0000 @@ -0,0 +1,169 @@ +Backport of: + +From 0a7c86b4807619b1ab52c18f091752d4f711d5b1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lo=C3=AFc=20Hoguin?= +Date: Tue, 25 Mar 2025 22:12:57 +0100 +Subject: [PATCH] Fix the exception logged by Cowboy caused by double reply + (#13612) + +Issue introduced in 383ddb16341. + +Authored-by: @lhoguin. +--- + .../src/rabbit_mgmt_util.erl | 17 +++++++++++++ + .../src/rabbit_mgmt_wm_exchange_publish.erl | 25 ++++++------------- + .../src/rabbit_mgmt_wm_queue_actions.erl | 24 ++++++------------ + .../src/rabbit_mgmt_wm_queue_get.erl | 24 ++++++------------ + 4 files changed, 41 insertions(+), 49 deletions(-) + +--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl ++++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl +@@ -51,6 +51,8 @@ + + -export([disable_stats/1, enable_queue_totals/1]). + ++-export([set_resp_not_found/2]). ++ + -import(rabbit_misc, [pget/2]). + + -include("rabbit_mgmt.hrl"). +@@ -1175,3 +1177,18 @@ catch_no_such_user_or_vhost(Fun, Replace + %% error is thrown when the request is out of range + sublist(List, S, L) when is_integer(L), L >= 0 -> + lists:sublist(lists:nthtail(S-1, List), L). ++ ++-spec set_resp_not_found(binary(), cowboy_req:req()) -> cowboy_req:req(). ++set_resp_not_found(NotFoundBin, ReqData) -> ++ ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of ++ not_found -> ++ <<"vhost_not_found">>; ++ _ -> ++ NotFoundBin ++ end, ++ ReqData1 = cowboy_req:set_resp_header( ++ <<"content-type">>, <<"application/json">>, ReqData), ++ cowboy_req:set_resp_body(rabbit_json:encode(#{ ++ <<"error">> => <<"not_found">>, ++ <<"reason">> => ErrorMessage ++ }), ReqData1). +--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl ++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl +@@ -29,11 +29,14 @@ allowed_methods(ReqData, Context) -> + content_types_provided(ReqData, Context) -> + {rabbit_mgmt_util:responder_map(to_json), ReqData, Context}. + +-resource_exists(ReqData, Context) -> +- {case rabbit_mgmt_wm_exchange:exchange(ReqData) of +- not_found -> raise_not_found(ReqData, Context); +- _ -> true +- end, ReqData, Context}. ++resource_exists(ReqData0, Context) -> ++ case rabbit_mgmt_wm_exchange:exchange(ReqData0) of ++ not_found -> ++ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"exchange_not_found">>, ReqData0), ++ {false, ReqData1, Context}; ++ _ -> ++ {true, ReqData0, Context} ++ end. + + allow_missing_post(ReqData, Context) -> + {false, ReqData, Context}. +@@ -104,18 +107,6 @@ bad({{coordinator_unavailable, _}, _}, R + is_authorized(ReqData, Context) -> + rabbit_mgmt_util:is_authorized_vhost(ReqData, Context). + +-raise_not_found(ReqData, Context) -> +- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of +- not_found -> +- "vhost_not_found"; +- _ -> +- "exchange_not_found" +- end, +- rabbit_mgmt_util:not_found( +- rabbit_data_coercion:to_binary(ErrorMessage), +- ReqData, +- Context). +- + %%-------------------------------------------------------------------- + + decode(Payload, <<"string">>) -> Payload; +--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl ++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl +@@ -25,11 +25,14 @@ variances(Req, Context) -> + allowed_methods(ReqData, Context) -> + {[<<"POST">>, <<"OPTIONS">>], ReqData, Context}. + +-resource_exists(ReqData, Context) -> +- {case rabbit_mgmt_wm_queue:queue(ReqData) of +- not_found -> raise_not_found(ReqData, Context); +- _ -> true +- end, ReqData, Context}. ++resource_exists(ReqData0, Context) -> ++ case rabbit_mgmt_wm_queue:queue(ReqData0) of ++ not_found -> ++ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"queue_not_found">>, ReqData0), ++ {false, ReqData1, Context}; ++ _ -> ++ {true, ReqData0, Context} ++ end. + + allow_missing_post(ReqData, Context) -> + {false, ReqData, Context}. +@@ -54,17 +57,6 @@ do_it(ReqData0, Context) -> + is_authorized(ReqData, Context) -> + rabbit_mgmt_util:is_authorized_admin(ReqData, Context). + +-raise_not_found(ReqData, Context) -> +- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of +- not_found -> +- "vhost_not_found"; +- _ -> +- "queue_not_found" +- end, +- rabbit_mgmt_util:not_found( +- rabbit_data_coercion:to_binary(ErrorMessage), +- ReqData, +- Context). + %%-------------------------------------------------------------------- + + action(Else, _Q, ReqData, Context) -> +--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl ++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl +@@ -29,11 +29,14 @@ allowed_methods(ReqData, Context) -> + content_types_provided(ReqData, Context) -> + {rabbit_mgmt_util:responder_map(to_json), ReqData, Context}. + +-resource_exists(ReqData, Context) -> +- {case rabbit_mgmt_wm_queue:queue(ReqData) of +- not_found -> raise_not_found(ReqData, Context); +- _ -> true +- end, ReqData, Context}. ++resource_exists(ReqData0, Context) -> ++ case rabbit_mgmt_wm_queue:queue(ReqData0) of ++ not_found -> ++ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"queue_not_found">>, ReqData0), ++ {false, ReqData1, Context}; ++ _ -> ++ {true, ReqData0, Context} ++ end. + + allow_missing_post(ReqData, Context) -> + {false, ReqData, Context}. +@@ -152,17 +155,6 @@ basic_get(Ch, Q, AckMode, Enc, Trunc) -> + is_authorized(ReqData, Context) -> + rabbit_mgmt_util:is_authorized_vhost(ReqData, Context). + +-raise_not_found(ReqData, Context) -> +- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of +- not_found -> +- "vhost_not_found"; +- _ -> +- "queue_not_found" +- end, +- rabbit_mgmt_util:not_found( +- rabbit_data_coercion:to_binary(ErrorMessage), +- ReqData, +- Context). + %%-------------------------------------------------------------------- + + maybe_truncate(Payload, none) -> Payload; diff -pruN 4.0.5-8/debian/patches/rabbitmq-dist.mk.patch 4.0.5-8ubuntu2/debian/patches/rabbitmq-dist.mk.patch --- 4.0.5-8/debian/patches/rabbitmq-dist.mk.patch 2025-08-11 12:31:10.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/patches/rabbitmq-dist.mk.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,19 +0,0 @@ -Description: make 4.3 compatibility change -Author: Yuriy Vidineev -Forwarded: no -Bug-Debian: https://bugs.debian.org/964636 -Last-Update: 2020-07-22 - ---- a/deps/rabbit_common/mk/rabbitmq-dist.mk -+++ b/deps/rabbit_common/mk/rabbitmq-dist.mk -@@ -69,8 +69,8 @@ - ifeq ($$(shell test -f $(3)/rabbitmq-components.mk \ - && grep -q '^list-dist-deps::' $(3)/Makefile && echo yes),yes) - $$(dist_$(1)_ez): $$(patsubst %,$(3)/%, \ -- $$(shell $(MAKE) --no-print-directory -C $(3) list-dist-deps \ -- APP=$(1) VSN=$(2) EZ_DIR=$$(abspath $$(dist_$(1)_ez_dir)))) -+ $$(shell env MAKEFLAGS=--no-print-directory $$(MAKE) -C $(3) list-dist-deps \ -+ APP=$(1) VSN=$(2) EZ_DIR=$$(abspath $$(dist_$(1)_ez_dir)) 2>/dev/null)) - endif - - ERLANGMK_DIST_APPS += $(1) diff -pruN 4.0.5-8/debian/patches/series 4.0.5-8ubuntu2/debian/patches/series --- 4.0.5-8/debian/patches/series 2025-08-11 12:31:10.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/patches/series 2025-09-19 15:33:56.000000000 +0000 @@ -1,3 +1,3 @@ lets-use-python3-not-python-binary.patch -rabbitmq-dist.mk.patch elixir-1.18-compat.patch +CVE-2025-50200.patch diff -pruN 4.0.5-8/debian/rules 4.0.5-8ubuntu2/debian/rules --- 4.0.5-8/debian/rules 2025-08-11 12:31:10.000000000 +0000 +++ 4.0.5-8ubuntu2/debian/rules 2025-08-13 13:57:51.000000000 +0000 @@ -38,7 +38,7 @@ override_dh_auto_install: < scripts/rabbitmq-script-wrapper \ > $(DEB_DESTDIR)$(PREFIX)/sbin/rabbitmqctl chmod 0755 $(DEB_DESTDIR)$(PREFIX)/sbin/rabbitmqctl - for script in rabbitmq-server rabbitmq-plugins rabbitmq-diagnostics rabbitmq-queues rabbitmq-upgrade; do \ + for script in rabbitmq-server rabbitmq-plugins rabbitmq-diagnostics rabbitmq-queues rabbitmq-upgrade rabbitmq-streams; do \ cp -a $(DEB_DESTDIR)$(PREFIX)/sbin/rabbitmqctl \ $(DEB_DESTDIR)$(PREFIX)/sbin/$$script; \ done