CVE-2016-8741: Apache Qpid Broker for Java - Exposure of Sensitive Information
Summary
CVE-2016-8741: Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java. Affects org.apache.qpid:qpid-broker across 2 version ranges.
>= 6.0.0, < 6.0.6
>= 6.1.0, < 6.1.1
Fixed in 6.0.6 or 6.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Broker for Java is a messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable message delivery, flexible routing, and support for various messaging patterns. The broker can be configured with different AuthenticationProviders for user authentication, including SCRAM-SHA-1 and SCRAM-SHA-256. These AuthenticationProviders handle the negotiation process for user authentication.
Vulnerability Detail
The SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProviders in Apache Qpid Broker for Java versions 6.0.x before 6.0.6 and 6.1.x before 6.1.1 have a vulnerability that allows an unauthorized remote attacker to determine the existence of user accounts. When a user name that does not exist is provided during the SCRAM SASL negotiation, these AuthenticationProviders prematurely terminate the negotiation process. This behavior can be exploited by an attacker to identify valid user accounts, potentially aiding in further attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.66.0.6 -
>= 6.1.0, < 6.1.16.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of Apache Qpid Broker for Java.
Conclusion
The vulnerability in Apache Qpid Broker for Java allows an unauthorized remote attacker to determine the existence of user accounts. Upgrading to the patched versions of the broker is necessary to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:qpid-broker →
FAQ
Apache Qpid Broker for Java is a messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable message delivery, flexible routing, and support for various messaging patterns.
SCRAM-SHA-1 and SCRAM-SHA-256 are authentication mechanisms that use the Salted Challenge Response Authentication Mechanism (SCRAM) for secure user authentication.
The vulnerability allows an unauthorized remote attacker to determine the existence of user accounts in the broker. This information can be used to target specific user accounts for further attacks.
No, only versions 6.0.x before 6.0.6 and 6.1.x before 6.1.1 are affected. Upgrading to the patched versions resolves the vulnerability.
No, there is no known workaround. It is recommended to upgrade to the patched versions of Apache Qpid Broker for Java.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:qpid-broker.
