Improper Input Validation in Apache Qpid AMQP 0-x JMS

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...

GHSA-3G2P-7C6P-VJ8C Apache Qpid Python client Improper certificate validation

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Apache Qpid Python client Improper certificate validation

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

RHEL 8 : Red Hat OpenStack Platform 16.1 (golang-qpid-apache) (RHSA-2022:0989)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0989 advisory. Golang binding library for qpid-proton Security Fixes: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (golang-qpid-apache) security update

An update for golang-qpid-apache is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : Red Hat OpenStack Platform 16.2 (golang-qpid-apache) (RHSA-2022:0997)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0997 advisory. Golang binding library for qpid-proton Security Fixes: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (golang-qpid-apache) security update

An update for golang-qpid-apache is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

qpid-proton:fuzz-connection-driver: Crash in pni_sniff_header

Project: https://github.com/apache/qpid-proton.git Detailed Report: https://oss-fuzz.com/testcase?key=5129755591049216 Project: qpid-proton Fuzzing Engine: afl Fuzz Target: fuzz-connection-driver Job Type: aflasanqpid-proton Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f3c6a1375c...

qpid-proton:fuzz-connection-driver: Heap-buffer-overflow in pn_buffer_append

Project: https://github.com/apache/qpid-proton.git Detailed Report: https://oss-fuzz.com/testcase?key=5990277035196416 Project: qpid-proton Fuzzing Engine: libFuzzer Fuzz Target: fuzz-connection-driver Job Type: libfuzzerasanqpid-proton Platform Id: linux Crash Type: Heap-buffer-overflow READ Cra...

qpid-proton:fuzz-message-decode: Heap-buffer-overflow in consume_list

Project: https://github.com/apache/qpid-proton.git Detailed Report: https://oss-fuzz.com/testcase?key=6101905114267648 Project: qpid-proton Fuzzing Engine: libFuzzer Fuzz Target: fuzz-message-decode Job Type: libfuzzerasanqpid-proton Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Cras...

CVE-2019-0223

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Authentication Bypass

org.apache.qpid, qpid-broker is vulnerable to authentication bypass. The vulnerability exists due to the function TrustManger allowing all certificates to pass the verification...

CVE-2019-3845

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent. A malicious user authenticated to a host registered to Satellite or Capsule can use this flaw to access QMF methods to any host also registered to Satellite or Capsule and...

Denial Of Service (DoS)

apache qpid is vulnerable to denial of service. A flaw was found in the way Apache Qpid handled a request to redeclare an existing exchange while adding a new alternate exchange. If a remote, authenticated user issued such a request, the server would crash, resulting in the cluster shutting down...

Denial Of Service (DoS)

apache qpid is vulnerable to denial of service. A flaw was found in the way Apache Qpid handled the receipt of invalid AMQP data. A remote user could send invalid AMQP data to the server, causing it to crash, resulting in the cluster shutting down...

CVE-2014-0212

qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...

UBUNTU-CVE-2014-0212

qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...

CVE-2014-0212

qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...

CVE-2014-0212

qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...

CVE-2014-0212

CVE-2014-0212 concerns qpid-cpp: ACL policies are only loaded when the acl-file option is specified, which can enable a Denial of Service by exhausting all available file descriptors. The connected documents confirm the root cause is loading/processing ACL policies contingent on a missing/omitted...