Pivotal RabbitMQ is included with NorthStar Controller. Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a Denial of Service (DoS) attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
 

This issue affects Juniper Networks NorthStar Controller versions prior to 6.2.3.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned CVE-2019-11287.

The following software releases have been updated to resolve this specific issue: NorthStar Controller 6.2.3, and all subsequent releases.

This issue is being tracked as 1650603.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

A workaround is to manually disable the affected component by changing the configuration file /opt/northstar/thirdparty/rabbitmq/etc/rabbitmq/enabled_plugins from:

to

After saving the file, restart the NorthStar services to apply the change:

Also to reduce the risk of exploitation use access controls or firewalls to limit access to the device only from trusted, administrative networks or hosts.

2023-01-11: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2019-11287 at cve.mitre.org
• https://pivotal.io/security/cve-2019-11287