RHEL 6 : qpid (RHSA-2015:0707)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0707 advisory. Red Hat Enterprise MRG is a next-generation IT infrastructure incorporating Messaging, Real Time, and Grid functionality. It offers increase...

CVE-2018-8030

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...

CVE-2018-8030

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...

Denial of service

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...

CVE-2018-8030

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit 100MB by default. The broker crashes due to the defect. AMQP protocols 0-10 and 1.0...

CVE-2018-8030

CVE-2018-8030 affects Apache Qpid Broker-J 7.0.0–7.0.4 when publishing AMQP messages larger than the default maximum (100 MB) using protocols 0-8, 0-9, or 0-91. The defect causes the broker to crash, representing a Denial of Service (DoS). Affected protocols 0-10 and 1.0 are not affected. The pro...

Denial Of Service (DoS)

apache-qpid-broker-j is vulnerable to denial of service DoS attacks. The vulnerability exists due to the incorrect maximum message size check...

Security Bulletin: IBM SmartCloud Orchestrator - OpenStack Compute SSL information disclosure (CVE-2013-6491)

Summary An attacker might exploit this vulnerability using man-in-the-middle techniques to obtain sensitive information. The python-qpid client common/rpc/implqpid.py in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpidprotocol is set to ssl. It allows remote attackers to...

qpid-proton/fuzz-connection-driver: Crash in __msan_memmove.part.53

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=6266408911503360 Project: qpid-proton Fuzzer: libFuzzerqpid-protonfuzz-connection-driver Fuzz target binary: fuzz-connection-driver Job Type: libfuzzermsanqpid-proton Platform Id: linux Crash Typ...

qpid-proton/fuzz-connection-driver: Index-out-of-bounds in pni_inspect_enter

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=6237435934539776 Project: qpid-proton Fuzzer: libFuzzerqpid-protonfuzz-connection-driver Fuzz target binary: fuzz-connection-driver Job Type: libfuzzerubsanqpid-proton Platform Id: linux Crash...

qpid-proton/fuzz-connection-driver: Negative-size-param in transport_consume

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=6301141305393152 Project: qpid-proton Fuzzer: aflqpid-protonfuzz-connection-driver Fuzz target binary: fuzz-connection-driver Job Type: aflasanqpid-proton Platform Id: linux Crash Type:...

qpid-proton/fuzz-message-decode: Heap-buffer-overflow in pni_decoder_decode_value

Project: https://github.com/apache/qpid-proton.git Detailed report: https://oss-fuzz.com/testcase?key=5311329584807936 Project: qpid-proton Fuzzer: aflqpid-protonfuzz-message-decode Fuzz target binary: fuzz-message-decode Job Type: aflasanqpid-proton Platform Id: linux Crash Type:...

Apache Qpid Denial of Service Vulnerability (CNVD-2018-03762)

Apache Qpid is the United States Apache Apache Software Foundation developed an object-oriented messaging middleware , it is an AMQP Advanced Message Queuing Protocol implementation , you can communicate with AMQP-compliant systems , and provides a C++, Python, Java, C and other programming...

CVE-2015-0203

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service daemon crash via an AMQP message with 1 an invalid range in a sequence set, 2 content-bearing methods other than message-transfer, or 3 a session-gap control before a corresponding...

CVE-2015-0203

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service daemon crash via an AMQP message with 1 an invalid range in a sequence set, 2 content-bearing methods other than message-transfer, or 3 a session-gap control before a corresponding...

Design/Logic Flaw

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service daemon crash via an AMQP message with 1 an invalid range in a sequence set, 2 content-bearing methods other than message-transfer, or 3 a session-gap control before a corresponding...

UBUNTU-CVE-2015-0203

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service daemon crash via an AMQP message with 1 an invalid range in a sequence set, 2 content-bearing methods other than message-transfer, or 3 a session-gap control before a corresponding...

CVE-2015-0203

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service daemon crash via an AMQP message with 1 an invalid range in a sequence set, 2 content-bearing methods other than message-transfer, or 3 a session-gap control before a corresponding...

CVE-2015-0203

CVE-2015-0203 affects the qpidd broker in Apache Qpid 0.30 and earlier. Root cause: mishandling of AMQP messages allows remote authenticated users to cause a denial of service (daemon crash) via (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3...

qpid-proton: reactor sends messages in clear if ssl is requested but not available

The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain...