CVE-2016-4432

Опубликовано: 01 июн. 2016

Источник: nvd

CVSS3: 9.1

CVSS2: 5

EPSS Низкий

Описание

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

Ссылки

http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E
Vendor Advisory
http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/538508/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035983
Broken Link
Third Party Advisory
VDB Entry
https://issues.apache.org/jira/browse/QPID-7257
Issue Tracking
Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743161
Patch
Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743393
Patch
Vendor Advisory
http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E
Vendor Advisory
http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/538508/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1035983
Broken Link
Third Party Advisory
VDB Entry
https://issues.apache.org/jira/browse/QPID-7257
Issue Tracking
Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743161
Patch
Vendor Advisory
https://svn.apache.org/viewvc?view=revision&revision=1743393
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*

Версия до 6.0.3 (исключая)

EPSS

Процентиль: 94%

0.08148

Низкий

9.1 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2016-4432

CVSS3: 9.1

ubuntu

больше 10 лет назад

CVE-2016-4432

redhat

больше 10 лет назад

CVE-2016-4432

CVSS3: 9.1

debian

больше 10 лет назад

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid J ...

GHSA-q66c-h853-gqw2

CVSS3: 9.1

github

почти 8 лет назад

AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication

EPSS

Процентиль: 94%

0.08148

Низкий

9.1 Critical

CVSS3

5 Medium

CVSS2

Дефекты

CWE-287