CVE-2012-4460

The CVE-2012-4460 issue affects Apache Qpid (0.20 and earlier) in the qpid::framing::Buffer class’ serializing/deserializing functions. Affects the Buffer component, enabling remote denial of service (assertion failure and daemon exit) via unspecified vectors, with a note that it could trigger an...

CVE-2015-0223

The vulnerability CVE-2015-0223 affects Apache Qpid 0.30 and earlier, where remote attackers could bypass qpidd access restrictions due to issues in 0-10 connection handling. Impact is unauthorized access risk without explicit exploit details provided; affected components are the qpidd broker in ...

CVE-2013-1909

The CVE-2013-1909 issue affects the Python client in Apache Qpid prior to version 2.2, which does not verify that the server hostname matches the certificate’s CN/subjectAltName. This enables MITM with arbitrary valid certificates. Red Hat RHSA-2013:1024 notes upgrading to enable proper TLS/SSL c...

CVE-2009-5005

CVE-2009-5005 affects Apache Qpid used in Red Hat Enterprise MRG Messaging and Grid before version 1.3. The vulnerability is in Cluster::deliveredEvent handling of AMQP data, allowing a remote attacker to trigger a denial of service (daemon crash and cluster outage) through invalid AMQP data. Red...

CVE-2012-2145

CVE-2012-2145 affects Apache Qpid 0.17 and earlier. The vulnerability arises from insufficient restriction of incoming client connections, enabling remote attackers to cause a denial of service through file descriptor exhaustion by establishing a large number of incomplete connections. Public ref...

CVE-2012-4458

CVE-2012-4458 affects Apache Qpid up to version 0.20, where the AMQP type decoder could be triggered by a connection.start-ok message containing a large number of zero-width elements in the client-properties map, leading to memory consumption and a potential denial of service (server crash). Publ...

CVE-2012-4459

CVE-2012-4459 affects Apache Qpid 0.20 and earlier. The root cause is an integer overflow in qpid::framing::Buffer::checkAvailable(), leading to an out-of-bounds read and remote DoS (crash) via a crafted message. Public details in connected advisories confirm this issue and note that Red Hat’s RH...

CVE-2012-3467

The CVE-2012-3467 issue affects Apache Qpid (qpidd) before the fixed updates, where the NullAuthenticator used for catch-up shadow connections allowed remote authentication bypass. Affected: Qpid components handling AMQP broker clustering (qpidd, and related messaging cluster setup). Root cause: ...