[GHSA-j497-x9hr-x34x] RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

[d3fenestrator]

Updates

• Affected products

Comments
github.com/streadway/amqp is the unmaintained predecessor of github.com/rabbitmq/amqp091-go; its README says "NOT ACTIVELY MAINTAINED. Consider using rabbitmq/amqp091-go". amqp091-go is a fork and shares this code.

The code fixed in amqp091-go by rabbitmq/amqp091-go@6959423 is present unchanged in the latest streadway/amqp release (v1.1.0): https://github.com/streadway/amqp/blob/v1.1.0/write.go#L239-L252

writeShortstr converts the string length to uint8 (L242) without checking that it fits in 255 bytes, then writes only b[:length] (L248). A longer string is silently truncated to len % 256 bytes and sent without any error, which is the silent data truncation described in this advisory. The fix returns an error when the string exceeds 255 bytes. v1.0.0 contains the same code.

streadway/amqp has no release containing the fix, so all versions (<= 1.1.0) are affected and there is no patched version.

[github]

Hi there @suchitd! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory