Описание
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
Отчет
This flaw only affects the clustered implementation in qpid-cpp (qpidd-cpp-server-cluster) which is only available in Red Hat Enterprise MRG. The qpid-cpp-server as provided with Red Hat Enterprise Linux 6 does not include this functionality, and is thus not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | mingw32-qpid-cpp | Not affected | ||
| Red Hat Enterprise Linux 6 | qpid-cpp | Not affected | ||
| Red Hat Enterprise MRG 1 | qpid-cpp | Will not fix | ||
| MRG for RHEL-5 v. 2 | condor | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | python-qpid | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | qpid-cpp-mrg | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | qpid-java | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | qpid-jca | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | qpid-qmf | Fixed | RHSA-2012:0529 | 30.04.2012 |
| MRG for RHEL-5 v. 2 | qpid-tests | Fixed | RHSA-2012:0529 | 30.04.2012 |
Показывать по
Дополнительная информация
Статус:
5.8 Medium
CVSS2
Связанные уязвимости
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
Apache Qpid 0.12 does not properly verify credentials during the joini ...
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
5.8 Medium
CVSS2