[JAMES-3593] Recommand RabbitMQ upgrade - prior 3.8.16 has multiple CVE

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.0
• Fix Version/s: 3.7.0
• Component/s: rabbitmq
• Assignee: Unassigned
• Reporter: Benoit Tellier
• Created: 05/Jun/21 01:16
• Updated: 14/Jun/21 02:50
• Resolved: 14/Jun/21 02:50

Description

According to https://www.rabbitmq.com/changelog.html RabbitMQ prior this version is subject to several CVE:

• https://tanzu.vmware.com/security/cve-2020-5419
• https://tanzu.vmware.com/security/cve-2021-22117
• https://tanzu.vmware.com/security/cve-2021-22116

We currently recommend running on `3.8.3`...

We should:

• [ ] Test James against RabbitMQ 3.8.16 (update the image in apache/james-project and getting a green build is enough)
• [ ] Recommand the upgrade in update instructions and changelog
• [ ] Check the documentation

Issue Links

• links to: GitHub Pull Request #475
• links to: GitHub Pull Request #488