AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication

2018-10-1619:49:48

Google

osv.dev

0.002 Low

EPSS

Percentile

61.0%

JSON

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

CPENameOperatorVersion
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocoleq0.30
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocoleq6.0.2
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocoleq6.0.2
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocoleq0.28
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocoleq0.32
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocoleq6.0.0
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocoleq6.0.0
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocoleq0.26
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocoleq0.32
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocoleq0.26

Name	Operator	Version
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol	eq	0.30
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol	eq	6.0.2
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol	eq	6.0.2
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol	eq	0.28
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol	eq	0.32
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol	eq	6.0.0
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol	eq	6.0.0
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol	eq	0.26
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol	eq	0.32
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol	eq	0.26