CVE-2012-4458

2013-03-1403:10:00

CWE-189

[email protected]

web.nvd.nist.gov

cve-2012-4458

apache qpid

amqp

denial of service

memory consumption

server crash

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.01 Low

EPSS

Percentile

83.5%

JSON

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.

CPENameOperatorVersion
apache:qpidapache qpideq0.14
apache:qpidapache qpideq0.7
apache:qpidapache qpideq0.15
apache:qpidapache qpideq0.10
apache:qpidapache qpideq0.17
apache:qpidapache qpidle0.20
apache:qpidapache qpideq0.9
apache:qpidapache qpideq0.13
apache:qpidapache qpideq0.6
apache:qpidapache qpideq0.11

CPE	Name	Operator	Version
apache:qpid	apache qpid	eq	0.14
apache:qpid	apache qpid	eq	0.7
apache:qpid	apache qpid	eq	0.15
apache:qpid	apache qpid	eq	0.10
apache:qpid	apache qpid	eq	0.17
apache:qpid	apache qpid	le	0.20
apache:qpid	apache qpid	eq	0.9
apache:qpid	apache qpid	eq	0.13
apache:qpid	apache qpid	eq	0.6
apache:qpid	apache qpid	eq	0.11