K23675185: Apache Qpid vulnerabilities CVE-2016-3094 and CVE-2016-4432

Security Advisory Description CVE-2016-3094 PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service broker termination via a crafted authentication attempt, which triggers an uncaught...

K89010078: Apache vulnerabilities CVE-2018-1307, CVE-2018-1298, CVE-2018-1299, CVE-2018-1287, and CVE-2018-1297

Security Advisory Description CVE-2018-1307 In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and...

SUSE CVE-2013-4261

OpenStack Compute Nova Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service connection pool consumption, as demonstrated using multiple requests that send...

SUSE CVE-2013-6491

The python-qpid client common/rpc/implqpid.py in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpidprotocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network...

SUSE CVE-2016-2166

The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain...

GHSA-5H6X-M52P-23PH Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton

Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the Qpid Proton C library and not org.apache.qpid:proton-j. This link has been maintained to preserve external references. Original Description While investigating bug PROTON-2014, we discovered that under...

Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton

Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the Qpid Proton C library and not org.apache.qpid:proton-j. This link has been maintained to preserve external references. Original Description While investigating bug PROTON-2014, we discovered that under...

com.korwe:kordapt-core (>=1.0.1, <=1.1.2), com.korwe:kordapt-gradle-plugin (>=1.0.1, <=1.1.2) +12 more potentially affected by CVE-2012-4446 via org.apache.qpid:qpid-client (>=0.10, <=0.18)

org.apache.qpid:qpid-client MAVEN version =0.10, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.8.0-ness-1, =0.4.0, =2.7.5, =1.0.3, =0.7.0.final, =0.8.0.final Source cves: CVE-2012-4446 Source advisory: OSV:GHSA-MRGH-6X42-X6XF...

com.korwe:kordapt-core (>=1.0.1, <=1.1.2), com.korwe:kordapt-gradle-plugin (>=1.0.1, <=1.1.2) +12 more potentially affected by CVE-2012-4446 via org.apache.qpid:qpid-client (>=0.10, <=0.18)

org.apache.qpid:qpid-client MAVEN version =0.10, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.8.0-ness-1, =0.4.0, =2.7.5, =1.0.3, =0.7.0.final, =0.8.0.final Source cves: CVE-2012-4446 Source advisory: GHSA-MRGH-6X42-X6XF...

Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

GHSA-MRGH-6X42-X6XF Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

com.itv:bucky-example_2.11 (>=0.10, <=1.4.5), com.itv:bucky-example_2.12 (>=0.10, <=1.4.5) +4 more potentially affected by CVE-2016-8741 via org.apache.qpid:qpid-broker (6.0.4)

org.apache.qpid:qpid-broker MAVEN version 6.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker and may be impacted: - com.itv:bucky-example2.11 =0.10, =0.10, =0.10, =0.10, =1.4.5 - com.itv:bucky-wiring2.11 1.4.5 -...

com.itv:bucky-example_2.11 (>=0.10, <=1.4.5), com.itv:bucky-example_2.12 (>=0.10, <=1.4.5) +4 more potentially affected by CVE-2016-8741 via org.apache.qpid:qpid-broker (6.0.4)

org.apache.qpid:qpid-broker MAVEN version 6.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker and may be impacted: - com.itv:bucky-example2.11 =0.10, =0.10, =0.10, =0.10, =1.4.5 - com.itv:bucky-wiring2.11 1.4.5 -...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...

GHSA-8VVH-CRQV-JM64 Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...

Apache QPID Allows Remote Authentication Bypass

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication...

GHSA-PHW8-FW9G-V3XC Apache QPID Allows Remote Authentication Bypass

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication...

GHSA-F38P-MQ64-H784 Improper Input Validation in Apache Qpid AMQP 0-x JMS

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...

de.dentrassi.kura.amqp:de.dentrassi.kura.camel.amqp.runtime (0.0.2), net.smolok:smolok-bootstrap (>=0.0.0, <=0.0.11) +16 more potentially affected by CVE-2016-4974 via org.apache.qpid:qpid-jms-client (>=0.1.0, <=0.9.0)

org.apache.qpid:qpid-jms-client MAVEN version =0.1.0, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.3, =0.0.4, =0.0.0, =0.0.0, =1.1.0, =1.2.0, =1.4.0 and more Source cves: CVE-2016-4974 Source advisory: OSV:GHSA-F38P-MQ64-H784...

de.dentrassi.kura.amqp:de.dentrassi.kura.camel.amqp.runtime (0.0.2), net.smolok:smolok-bootstrap (>=0.0.0, <=0.0.11) +16 more potentially affected by CVE-2016-4974 via org.apache.qpid:qpid-jms-client (>=0.1.0, <=0.9.0)

org.apache.qpid:qpid-jms-client MAVEN version =0.1.0, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.3, =0.0.4, =0.0.0, =0.0.0, =1.1.0, =1.2.0, =1.4.0 and more Source cves: CVE-2016-4974 Source advisory: GHSA-F38P-MQ64-H784...