CVE-2017-15701

The CVE-2017-15701 entry applies to Apache Qpid Broker-J versions 6.1.0–6.1.4, where AMQP 1.0 frame size is not properly enforced, allowing a remote unauthenticated attacker to exhaust memory and cause DoS. A fix is available in 6.1.5 and later; upgrade to 6.1.5+ or apply the applicable mitigatio...

CVE-2017-15702

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider tha...

Denial Of Service (DoS)

qpid-broker-plugins-amqp-1-0-protocol is vulnerable to denial of service DoS attacks. The application does not have a maximum size for frames, allowing a malicious user to pass large frames to the application that can cause memory exhaustion...

PT-2017-14151 · Apache · Apache Qpid Broker-J

Name of the Vulnerable Software and Affected Versions: Apache Qpid Broker-J versions 0.18 through 0.32 Description: The issue allows a remote unauthenticated attacker to trick the broker into using an authentication provider configured on a different port when connecting to an HTTP port. This...

PT-2017-14150 · Apache · Apache Qpid Broker-J

Name of the Vulnerable Software and Affected Versions: Apache Qpid Broker-J versions 6.1.0 through 6.1.4 Description: The issue arises from the broker's failure to properly enforce a maximum frame size in AMQP 1.0 frames, allowing a remote unauthenticated attacker to cause the broker to exhaust a...

CVE-2017-15699

A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and...

Design/Logic Flaw

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

CVE-2015-0224

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

CVE-2015-0224

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

CVE-2015-0224

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service daemon crash via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203...

CVE-2015-0224

CVE-2015-0224 affects qpidd (Apache Qpid) 0.30 and earlier. The vulnerability enables remote denial of service (daemon crash) via a crafted protocol sequence set, and exists due to an incomplete fix for CVE-2015-0203. Public details in connected assessors note the issue is tied to the qpidd broke...

PT-2017-6436 · Apache · Apache Qpid

Name of the Vulnerable Software and Affected Versions: Apache Qpid versions 0.30 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a crafted protocol sequence set. This problem exists due to an incomplete fix for a...

Code injection

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp...

CVE-2015-5164

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp...

CVE-2015-5164

CVE-2015-5164 affects the Qpid server used by Red Hat Satellite 6. The issue arises from improper restriction of message types, enabling remote authenticated administrators on a managed content host to execute arbitrary code via a crafted message, tied to a pickle processing problem in pulp. Publ...

CVE-2015-5164

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp...

CVE-2016-3696

The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key...

PT-2017-8411 · Pulp · Pulp

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.5 Description: The issue allows local users to obtain the CA key due to a problem in the pulp-qpid-ssl-cfg script. Recommendations: For versions prior to 2.8.5, update to version 2.8.5 or later to resolve the issue...

Authentication flaw

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...

CVE-2016-8741

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for...