CVE-2018-8030: Denial of Service Vulnerability in Apache Qpid Broker-J
Summary
CVE-2018-8030: Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents. Affects org.apache.qpid:apache-qpid-broker-j versions >= 7.0.0, < 7.1.0. Fixed in 7.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Broker-J is a messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable and scalable messaging services for applications. The vulnerability affects versions 7.0.0 to 7.0.4 of the Apache Qpid Broker-J when using AMQP protocols 0-8, 0-9, or 0-91. These protocols allow the publishing of messages with a size greater than the maximum message size limit, leading to a denial of service (DoS) condition. The broker crashes due to this defect. It's important to note that AMQP protocols 0-10 and 1.0 are not affected by this vulnerability.
Vulnerability Detail
The vulnerability allows an attacker to exploit the Apache Qpid Broker-J by sending messages larger than the allowed maximum message size limit. This triggers a DoS condition, causing the broker to crash. The impact of this vulnerability is a disruption of messaging services, potentially affecting the availability of applications relying on the broker. The vulnerability is rated as HIGH severity with a CVSS score of 7.5. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-20.
How To Fix
Minimum fixed version
7.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to the patched version of Apache Qpid Broker-J.
Conclusion
The Denial of Service vulnerability in Apache Qpid Broker-J can be mitigated by upgrading to version 7.0.5 or later. This ensures that the broker can handle messages of any size without crashing. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:apache-qpid-broker-j →
FAQ
Apache Qpid Broker-J is a messaging broker that implements the Advanced Message Queuing Protocol (AMQP). It provides reliable and scalable messaging services for applications.
Versions 7.0.0 to 7.0.4 of Apache Qpid Broker-J are affected by this vulnerability.
AMQP protocols 0-8, 0-9, and 0-91 are affected by this vulnerability. However, protocols 0-10 and 1.0 are not affected.
The vulnerability can lead to a denial of service (DoS) condition, causing the Apache Qpid Broker-J to crash. This disrupts messaging services and may impact the availability of applications relying on the broker.
To fix this vulnerability, upgrade to Apache Qpid Broker-J version 7.0.5 or later, which includes a fix for the defect.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:apache-qpid-broker-j.
