CVE-2010-3083 sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outa...
MediumCVSS 4.3
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache qpid | = 0.5 | No fix listed |
| apache qpid | = 0.6 | No fix listed |
| redhat enterprise mrg | <= 1.2 | No fix listed |
| redhat enterprise mrg | = 1.0 | No fix listed |
| redhat enterprise mrg | = 1.0.1 | No fix listed |
| redhat enterprise mrg | = 1.0.2 | No fix listed |
| redhat enterprise mrg | = 1.0.3 | No fix listed |
| redhat enterprise mrg | = 1.1.1 | No fix listed |
| redhat enterprise mrg | = 1.1.2 | No fix listed |
References
- 41710 third-party-advisory
- svn.apache.org patch
- [oss-security] 20101007 qpidd SSL connection DoS (CVE-2010-3083) mailing-list
- RHSA-2010:0756 patch vendor-advisory
- RHSA-2010:0757 patch vendor-advisory
- bugzilla.redhat.com