Bug#1002956: Remote RCE in rabbitmq-server

[Tim Abbott <tabbott@zulipchat.com>]

On Wed, Aug 3, 2022 at 12:22 AM Thomas Goirand <zigo@debian.org> wrote:

Hi Tim,

Please don't top-post, we don't do that in Debian, and also:

Apologies! 

FYI, I'm sad too, but there's nothing I can do but pinging again the
stable release team about this. You hear me well: the stable release
team. Not the security team since they do not want to do a security
announcement and an update through stable-security (so it shall be done
through a point release, dealing with the stable release team).

This means writing to 1002956@bugs.debian.org. That's the only email
address that has influence on accepting the fixed version. Feel free to
ping that email address until you get a reply. I agree that no reply
since the 29th of Jan is sad...

I still don't understand why the determination was made to not do a security announcement for this bug, given that it makes a Debian system that installs this package vulnerable to remote RCE without manual intervention. 

But given that determination was made, perhaps the best way I can contribute is by making sure this bug thread links to https://blog.zulip.com/2022/01/25/zulip-server-4-9-security-release/#cve-2021-43799-remote-code-execution-vulnerability-involving-rabbitmq, which has a bunch of public context about the impact of this bug, as well as background explanation that may help release managers who don't know much about Erlang/RabbitMQ.

-Tim Abbott