648 matches found
CVE-2013-1909
The CVE-2013-1909 issue affects the Python client in Apache Qpid prior to version 2.2, which does not verify that the server hostname matches the certificate’s CN/subjectAltName. This enables MITM with arbitrary valid certificates. Red Hat RHSA-2013:1024 notes upgrading to enable proper TLS/SSL c...
CVE-2013-4261
OpenStack Compute Nova Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service connection pool consumption, as demonstrated using multiple requests that send...
Oracle Linux 6 : qpid (ELSA-2012-1269)
The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1269 advisory. python-qpid 0.14-11 - BZs: 825078 - Resolves: rhbz840053 qpid-cpp 0.14-22.0.1.el63 - Update summary and description in specfile to be product neutral 0.14-22 -...
python-qpid: client does not validate qpid server TLS/SSL certificate
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-4459
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...
CVE-2012-4460
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...
CVE-2012-4458
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...
CVE-2012-4446
The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...
UBUNTU-CVE-2012-4459
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...
CVE-2012-4460
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...
CVE-2012-4458
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...
UBUNTU-CVE-2012-4460
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...
UBUNTU-CVE-2012-4446
The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...
UBUNTU-CVE-2012-4458
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...
Authentication flaw
The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...
Integer overflow
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...
Out-of-bounds
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...
Design/Logic Flaw
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...
CVE-2012-4459
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...
CVE-2012-4446
The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...