K23675185: Apache Qpid vulnerabilities CVE-2016-3094 and CVE-2016-4432

Security Advisory Description CVE-2016-3094 PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service broker termination via a crafted authentication attempt, which triggers an uncaught...

io.snamp.features:wrapped-libs-for-tests (2.0.0), org.apache.qpid:qpid-bdbstore (0.32) +4 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (0.32)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version 0.32 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol and may be impacted: - io.snamp.features:wrapped-libs-for-tests 2.0.0 -...

com.dell.cpsd.common.messaging:common-testing (1.5.0), com.dell.cpsd:common-testing (>=2.0.0, <=2.2.0) +4 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (0.28)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version 0.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol and may be impacted: - com.dell.cpsd.common.messaging:common-testing 1.5.0 -...

com.confluex:qpid-in-a-can (0.2.0), org.apache.qpid:qpid-bdbstore (0.24) +14 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (0.24)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version 0.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol and may be impacted: - com.confluex:qpid-in-a-can 0.2.0 -...

io.relayr:rabbitmq-scala-client_2.10 (>=0.1, <=0.1.1), io.relayr:rabbitmq-scala-client_2.11 (>=0.1, <=0.1.1) +5 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (0.30)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version 0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol and may be impacted: - io.relayr:rabbitmq-scala-client2.10 =0.1, =0.1, =0.1.1...

org.apache.qpid:qpid-broker (>=6.0.0, <=6.0.2), org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0 (>=6.0.0, <=6.0.2) +1 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (>=6.0.0, <=6.0.2)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.2 Source cves: CVE-2016-4432 Source advisory: OSV:GHSA-Q66C-H853-GQW2...

com.dell.cpsd.common.messaging:common-testing (1.5.0), com.dell.cpsd:common-testing (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (0.28)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version 0.28 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol and may be impacted: - com.dell.cpsd.common.messaging:common-testing 1.5.0 -...

org.apache.qpid:qpid-broker (>=6.0.0, <=6.0.2), org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0 (>=6.0.0, <=6.0.2) +1 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (>=6.0.0, <=6.0.2)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.2 Source cves: CVE-2016-4432 Source advisory: GHSA-Q66C-H853-GQW2...

com.confluex:qpid-in-a-can (0.2.0), org.apache.qpid:qpid-bdbstore (0.24) +14 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (0.24)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version 0.24 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol and may be impacted: - com.confluex:qpid-in-a-can 0.2.0 -...

io.relayr:rabbitmq-scala-client_2.10 (>=0.1, <=0.1.1), io.relayr:rabbitmq-scala-client_2.11 (>=0.1, <=0.1.1) +3 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (0.30)

org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol MAVEN version 0.30 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol and may be impacted: - io.relayr:rabbitmq-scala-client2.10 =0.1, =0.1, =0.1.1...

SOL23675185 - Apache Qpid vulnerabilities CVE-2016-3094 and CVE-2016-4432

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

CVE-2016-4432

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging...

CVE-2016-4432

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging...

com.confluex:qpid-in-a-can (0.2.0), com.dell.cpsd.common.messaging:common-testing (1.5.0) +20 more potentially affected by CVE-2016-4432 via org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol (>=0.24, <=6.0.2)

org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol MAVEN version =0.24, =2.0.0, =1.0.0, =0.1, =0.1, =0.24, =0.24, =0.24, =0.24, =6.0.2 and more Source cves: CVE-2016-4432 Source advisory: MEND:CVE-2016-4432...

CVE-2016-4432

CVE-2016-4432 affects Apache Qpid Java broker before 6.0.3. The AMQP 0-8/0-9/0-91/0-10 connection handling could allow remote attackers to bypass authentication and perform actions via vectors related to connection state logging. The connected documents corroborate the vulnerability in the Java b...