CVE-2012-3467 Apache QPID Allows Remote Authentication Bypass
MediumCVSS 5.0
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.qpid/qpid-parent(Maven) | < 0.17 | 0.17 |
| apache qpid | <= 0.16 | No fix listed |
| apache qpid | = 0.5 | No fix listed |
| apache qpid | = 0.6 | No fix listed |
| apache qpid | = 0.14 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- apache-qpid-broker-sec-bypass(77568) vdb-entry
- issues.apache.org
- RHSA-2012:1277 vendor-advisory
- RHSA-2012:1279 vendor-advisory
- svn.apache.org
- [oss-security] 20120809 CVE-2012-3467: Unauthorized access (authentication bypass) from client to broker due to use of NullAuthenticator in shadow connections mailing-list
- web.archive.org
- github.com
- github.com product
- 50186 third-party-advisory vendor-advisory
- 50698 third-party-advisory
- 54954 vdb-entry