History

Alex Vandiver a46f6df91e CVE-2021-43799: Write rabbitmq configuration before starting. Zulip writes a `rabbitmq.config` configuration file which locks down RabbitMQ to listen only on localhost:5672, as well as the RabbitMQ distribution port, on localhost:25672. The "distribution port" is part of Erlang's clustering configuration; while it is documented that the protocol is fundamentally insecure ([1], [2]) and can result in remote arbitrary execution of code, by default the RabbitMQ configuration on Debian and Ubuntu leaves it publicly accessible, with weak credentials. The configuration file that Zulip writes, while effective, is only written _after_ the package has been installed and the service started, which leaves the port exposed until RabbitMQ or system restart. Ensure that rabbitmq's `/etc/rabbitmq/rabbitmq.config` is written before rabbitmq is installed or starts, and that changes to that file trigger a restart of the service, such that the ports are only ever bound to localhost. This does not mitigate existing installs, since it does not force a rabbitmq restart. [1] https://www.erlang.org/doc/apps/erts/erl_dist_protocol.html [2] https://www.erlang.org/doc/reference_manual/distributed.html#distributed-erlang-system		2022-01-25 01:48:05 +00:00
..
architecture-overview.md	docs: Format Markdown with Prettier.	2021-09-08 12:06:24 -07:00
changelog.md	CVE-2021-43799: Write rabbitmq configuration before starting.	2022-01-25 01:48:05 +00:00
contributing.md	…
directory-structure.md	docs: Update all links to Django docs to point to version /3.2/.	2021-11-08 18:06:16 -08:00
index.md	docs: Convert reST index pages to Markdown.	2021-08-20 06:22:42 -07:00
readme.md	…
release-lifecycle.md	docs: Consistently hyphenate “self-host” and “self-service”.	2022-01-05 16:21:35 -08:00

readme.md

Zulip overview

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. Fortune 500 companies, leading open source projects, and thousands of other organizations use Zulip every day. Zulip is the only modern team chat app that is designed for both live and asynchronous conversations.

Zulip is built by a distributed community of developers from all around the world, with 74+ people who have each contributed 100+ commits. With over 1000 contributors merging over 500 commits a month, Zulip is the largest and fastest growing open source team chat project.

Getting started

Click on the appropriate link below. If nothing seems to apply, join us on the Zulip community server and tell us what's up!