Skip to content

Commit bf595b2

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch rabbitmq-server for CVE-2025-50200 [MEDIUM] (microsoft#14950)
1 parent 56b5307 commit bf595b2

File tree

2 files changed

+182
-1
lines changed

2 files changed

+182
-1
lines changed

‎SPECS/rabbitmq-server/CVE-2025-50200.patch‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
From e893d6bdaabfcb98472b115213c1af0522be7517 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Wed, 29 Oct 2025 05:28:18 +0000
4+
Subject: [PATCH] Fix Cowboy crashes caused by double reply: set_resp_not_found
5+
helper and adjust resource_exists in mgmt WM modules
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
8+
Upstream-reference: AI Backport of https://github.com/rabbitmq/rabbitmq-server/pull/13612.patch
9+
---
10+
.../src/rabbit_mgmt_util.erl | 17 +++++++++++++
11+
.../src/rabbit_mgmt_wm_exchange_publish.erl | 25 ++++++-------------
12+
.../src/rabbit_mgmt_wm_queue_actions.erl | 24 ++++++------------
13+
.../src/rabbit_mgmt_wm_queue_get.erl | 24 ++++++------------
14+
4 files changed, 41 insertions(+), 49 deletions(-)
15+
16+
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
17+
index 99a8436..9c4c65d 100644
18+
--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
19+
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
20+
@@ -51,6 +51,8 @@
21+
22+
-export([disable_stats/1, enable_queue_totals/1]).
23+
24+
+-export([set_resp_not_found/2]).
25+
+
26+
-import(rabbit_misc, [pget/2]).
27+
28+
-include("rabbit_mgmt.hrl").
29+
@@ -1145,3 +1147,18 @@ catch_no_such_user_or_vhost(Fun, Replacement) ->
30+
%% error is thrown when the request is out of range
31+
sublist(List, S, L) when is_integer(L), L >= 0 ->
32+
lists:sublist(lists:nthtail(S-1, List), L).
33+
+
34+
+-spec set_resp_not_found(binary(), cowboy_req:req()) -> cowboy_req:req().
35+
+set_resp_not_found(NotFoundBin, ReqData) ->
36+
+ ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of
37+
+ not_found ->
38+
+ <<"vhost_not_found">>;
39+
+ _ ->
40+
+ NotFoundBin
41+
+ end,
42+
+ ReqData1 = cowboy_req:set_resp_header(
43+
+ <<"content-type">>, <<"application/json">>, ReqData),
44+
+ cowboy_req:set_resp_body(rabbit_json:encode(#{
45+
+ <<"error">> => <<"not_found">>,
46+
+ <<"reason">> => ErrorMessage
47+
+ }), ReqData1).
48+
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl
49+
index 5a2dc27..381482a 100644
50+
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl
51+
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_exchange_publish.erl
52+
@@ -29,11 +29,14 @@ allowed_methods(ReqData, Context) ->
53+
content_types_provided(ReqData, Context) ->
54+
{rabbit_mgmt_util:responder_map(to_json), ReqData, Context}.
55+
56+
-resource_exists(ReqData, Context) ->
57+
- {case rabbit_mgmt_wm_exchange:exchange(ReqData) of
58+
- not_found -> raise_not_found(ReqData, Context);
59+
- _ -> true
60+
- end, ReqData, Context}.
61+
+resource_exists(ReqData0, Context) ->
62+
+ case rabbit_mgmt_wm_exchange:exchange(ReqData0) of
63+
+ not_found ->
64+
+ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"exchange_not_found">>, ReqData0),
65+
+ {false, ReqData1, Context};
66+
+ _ ->
67+
+ {true, ReqData0, Context}
68+
+ end.
69+
70+
allow_missing_post(ReqData, Context) ->
71+
{false, ReqData, Context}.
72+
@@ -104,18 +107,6 @@ bad({{coordinator_unavailable, _}, _}, ReqData, Context) ->
73+
is_authorized(ReqData, Context) ->
74+
rabbit_mgmt_util:is_authorized_vhost(ReqData, Context).
75+
76+
-raise_not_found(ReqData, Context) ->
77+
- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of
78+
- not_found ->
79+
- "vhost_not_found";
80+
- _ ->
81+
- "exchange_not_found"
82+
- end,
83+
- rabbit_mgmt_util:not_found(
84+
- rabbit_data_coercion:to_binary(ErrorMessage),
85+
- ReqData,
86+
- Context).
87+
-
88+
%%--------------------------------------------------------------------
89+
90+
decode(Payload, <<"string">>) -> Payload;
91+
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl
92+
index f11d2fd..eb41b8d 100644
93+
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl
94+
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_actions.erl
95+
@@ -26,11 +26,14 @@ variances(Req, Context) ->
96+
allowed_methods(ReqData, Context) ->
97+
{[<<"POST">>, <<"OPTIONS">>], ReqData, Context}.
98+
99+
-resource_exists(ReqData, Context) ->
100+
- {case rabbit_mgmt_wm_queue:queue(ReqData) of
101+
- not_found -> raise_not_found(ReqData, Context);
102+
- _ -> true
103+
- end, ReqData, Context}.
104+
+resource_exists(ReqData0, Context) ->
105+
+ case rabbit_mgmt_wm_queue:queue(ReqData0) of
106+
+ not_found ->
107+
+ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"queue_not_found">>, ReqData0),
108+
+ {false, ReqData1, Context};
109+
+ _ ->
110+
+ {true, ReqData0, Context}
111+
+ end.
112+
113+
allow_missing_post(ReqData, Context) ->
114+
{false, ReqData, Context}.
115+
@@ -55,17 +58,6 @@ do_it(ReqData0, Context) ->
116+
is_authorized(ReqData, Context) ->
117+
rabbit_mgmt_util:is_authorized_admin(ReqData, Context).
118+
119+
-raise_not_found(ReqData, Context) ->
120+
- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of
121+
- not_found ->
122+
- "vhost_not_found";
123+
- _ ->
124+
- "queue_not_found"
125+
- end,
126+
- rabbit_mgmt_util:not_found(
127+
- rabbit_data_coercion:to_binary(ErrorMessage),
128+
- ReqData,
129+
- Context).
130+
%%--------------------------------------------------------------------
131+
132+
action(<<"sync">>, Q, ReqData, Context) when ?is_amqqueue(Q) ->
133+
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl
134+
index d08439b..31d32c1 100644
135+
--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl
136+
+++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_queue_get.erl
137+
@@ -29,11 +29,14 @@ allowed_methods(ReqData, Context) ->
138+
content_types_provided(ReqData, Context) ->
139+
{rabbit_mgmt_util:responder_map(to_json), ReqData, Context}.
140+
141+
-resource_exists(ReqData, Context) ->
142+
- {case rabbit_mgmt_wm_queue:queue(ReqData) of
143+
- not_found -> raise_not_found(ReqData, Context);
144+
- _ -> true
145+
- end, ReqData, Context}.
146+
+resource_exists(ReqData0, Context) ->
147+
+ case rabbit_mgmt_wm_queue:queue(ReqData0) of
148+
+ not_found ->
149+
+ ReqData1 = rabbit_mgmt_util:set_resp_not_found(<<"queue_not_found">>, ReqData0),
150+
+ {false, ReqData1, Context};
151+
+ _ ->
152+
+ {true, ReqData0, Context}
153+
+ end.
154+
155+
allow_missing_post(ReqData, Context) ->
156+
{false, ReqData, Context}.
157+
@@ -152,17 +155,6 @@ basic_get(Ch, Q, AckMode, Enc, Trunc) ->
158+
is_authorized(ReqData, Context) ->
159+
rabbit_mgmt_util:is_authorized_vhost(ReqData, Context).
160+
161+
-raise_not_found(ReqData, Context) ->
162+
- ErrorMessage = case rabbit_mgmt_util:vhost(ReqData) of
163+
- not_found ->
164+
- "vhost_not_found";
165+
- _ ->
166+
- "queue_not_found"
167+
- end,
168+
- rabbit_mgmt_util:not_found(
169+
- rabbit_data_coercion:to_binary(ErrorMessage),
170+
- ReqData,
171+
- Context).
172+
%%--------------------------------------------------------------------
173+
174+
maybe_truncate(Payload, none) -> Payload;
175+
--
176+
2.45.4
177+

‎SPECS/rabbitmq-server/rabbitmq-server.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,15 @@
22
Summary: rabbitmq-server
33
Name: rabbitmq-server
44
Version: 3.13.7
5-
Release: 2%{?dist}
5+
Release: 3%{?dist}
66
License: Apache-2.0 and MPL 2.0
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
99
Group: Development/Languages
1010
URL: https://rabbitmq.com
1111
Source0: https://github.com/rabbitmq/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
1212
Patch0: CVE-2025-30219.patch
13+
Patch1: CVE-2025-50200.patch
1314

1415
BuildRequires: elixir
1516
BuildRequires: erlang
@@ -66,6 +67,9 @@ done
6667
%{_libdir}/rabbitmq/lib/rabbitmq_server-%{version}/*
6768

6869
%changelog
70+
* Wed Oct 29 2025 Azure Linux Security Servicing Account <[email protected]> - 3.13.7-3
71+
- Patch for CVE-2025-50200
72+
6973
* Mon Mar 31 2025 Ankita Pareek <[email protected]> - 3.13.7-2
7074
- Address CVE-2025-30219 with a patch
7175

0 commit comments

Comments
 (0)