Описание
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
A flaw was found in RabbitMQ. A remote attacker can bypass authentication by providing a valid username while omitting the password in an MQ Telemetry Transport (MQTT) connection request. This allows unauthorized attackers to connect to the message broker without supplying valid credentials.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | rabbitmq-server | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | rabbitmq-server | Will not fix | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | rabbitmq-server | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) | rabbitmq-server | Will not fix | ||
| Red Hat OpenStack Platform 11 (Ocata) | rabbitmq-server | Will not fix | ||
| Red Hat OpenStack Platform 8 (Liberty) | rabbitmq-server | Will not fix | ||
| Red Hat OpenStack Platform 9 (Mitaka) | rabbitmq-server | Will not fix | ||
| Red Hat Storage Console 2 | rabbitmq-server | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x ...
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
EPSS
5.9 Medium
CVSS3