Improper Input Validation in org.apache.qpid:qpid-broker

2018-10-1619:50:13

Google

osv.dev

0.014 Low

EPSS

Percentile

86.3%

JSON

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

CPENameOperatorVersion
org.apache.qpid:qpid-brokereq0.24
org.apache.qpid:qpid-brokereq0.22
org.apache.qpid:qpid-brokereq0.30
org.apache.qpid:qpid-brokereq6.0.0
org.apache.qpid:qpid-brokereq0.20
org.apache.qpid:qpid-brokereq0.28
org.apache.qpid:qpid-brokereq6.0.1
org.apache.qpid:qpid-brokereq6.0.2
org.apache.qpid:qpid-brokereq0.26
org.apache.qpid:qpid-brokereq0.32

Name	Operator	Version
org.apache.qpid:qpid-broker	eq	0.24
org.apache.qpid:qpid-broker	eq	0.22
org.apache.qpid:qpid-broker	eq	0.30
org.apache.qpid:qpid-broker	eq	6.0.0
org.apache.qpid:qpid-broker	eq	0.20
org.apache.qpid:qpid-broker	eq	0.28
org.apache.qpid:qpid-broker	eq	6.0.1
org.apache.qpid:qpid-broker	eq	6.0.2
org.apache.qpid:qpid-broker	eq	0.26
org.apache.qpid:qpid-broker	eq	0.32