CVE-2017-15701: Apache Qpid Broker-J Denial of Service (DoS) Vulnerability
Summary
CVE-2017-15701: Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption. Affects org.apache.qpid:qpid-broker versions >= 6.1.0, < 6.1.5. Fixed in 6.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Broker-J is an open-source messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable and scalable messaging for distributed systems. The vulnerability affects versions 6.1.0 through 6.1.4 of the broker. The AMQP 1.0 frames in these versions do not enforce a maximum frame size, allowing a remote unauthenticated attacker to exploit this vulnerability. By sending specially crafted frames, the attacker can cause the broker to consume excessive memory, leading to a denial of service (DoS) condition. Older AMQP protocols are not affected.
Vulnerability Detail
The vulnerability in Apache Qpid Broker-J allows an attacker to exhaust all available memory on the broker by sending malicious AMQP 1.0 frames. This can lead to the termination of the broker, causing a denial of service (DoS) condition. The lack of proper enforcement of a maximum frame size allows the attacker to consume resources beyond the system's capacity. The impact of this vulnerability can be severe, as it can disrupt the messaging infrastructure and affect the availability of the system.
How To Fix
Minimum fixed version
6.1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Apache Qpid Broker-J.
Conclusion
Apache Qpid Broker-J versions 6.1.0 through 6.1.4 are vulnerable to a Denial of Service (DoS) attack due to the lack of proper enforcement of a maximum frame size in AMQP 1.0 frames. Upgrading to version 6.1.5 or later is crucial to fix this vulnerability and prevent resource exhaustion. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:qpid-broker →
FAQ
Apache Qpid Broker-J is an open-source messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable and scalable messaging for distributed systems.
Versions 6.1.0 through 6.1.4 (inclusive) of Apache Qpid Broker-J are affected by this vulnerability.
The vulnerability allows an attacker to exhaust all available memory on the broker, leading to a denial of service (DoS) condition. This can disrupt the messaging infrastructure and affect the availability of the system.
No, only AMQP 1.0 frames in versions 6.1.0 through 6.1.4 of Apache Qpid Broker-J are affected. Older AMQP protocols are not vulnerable.
To mitigate the risk, it is recommended to upgrade to version 6.1.5 or later of Apache Qpid Broker-J, which includes the necessary fix to enforce a maximum frame size in AMQP 1.0 frames.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:qpid-broker.
