CVE-2018-1298: Apache Qpid Broker-J Denial of Service Vulnerability
Summary
CVE-2018-1298: Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j. Affects org.apache.qpid:apache-qpid-broker-j versions >= 7.0.0, < 7.0.1. Fixed in 7.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Broker-J is an open-source messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides functionality for authentication of connections for various AMQP protocols. The vulnerability affects version 7.0.0 of the Apache Qpid Broker-J and is related to the authentication process for AMQP connections using the PLAIN or XOAUTH2 SASL mechanisms. The vulnerability allows an unauthenticated attacker to crash the broker instance, potentially disrupting messaging services. AMQP 1.0 and HTTP connections are not affected. The authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers".
Vulnerability Detail
The vulnerability arises from a flaw in the authentication process of Apache Qpid Broker-J. When the PLAIN or XOAUTH2 SASL mechanism is used for AMQP connections, an unauthenticated attacker can exploit this vulnerability to crash the broker instance. This can lead to a denial of service, impacting the availability of messaging services. The vulnerability affects the following types of Authentication Providers: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1, and OAuth2. If an AMQP port is configured with any of these Authentication Providers, the broker may be vulnerable.
How To Fix
Minimum fixed version
7.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of Apache Qpid Broker-J.
Conclusion
In conclusion, the CVE-2018-1298 vulnerability in Apache Qpid Broker-J can be exploited by an unauthenticated attacker to crash the broker instance, leading to a denial of service. It is crucial to upgrade to a fixed version of Apache Qpid Broker-J, such as version 7.0.1, to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:apache-qpid-broker-j →
FAQ
Apache Qpid Broker-J is an open-source messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable messaging services for distributed systems.
The vulnerability affects version 7.0.0 of Apache Qpid Broker-J. Earlier versions may also be affected, but this has not been confirmed.
The vulnerability allows an unauthenticated attacker to crash the broker instance, potentially disrupting messaging services. However, AMQP 1.0 and HTTP connections are not affected.
No specific workarounds have been provided for this vulnerability. It is recommended to upgrade to a fixed version of Apache Qpid Broker-J.
To fix this vulnerability, it is recommended to upgrade to version 7.0.1 of Apache Qpid Broker-J or a later version. This will address the flaw in the authentication process and prevent the possibility of a denial of service attack.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:apache-qpid-broker-j.
