CVE-2016-9877 An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport)...
CriticalCVSS 9.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/rabbitmq-server(Debian:12) | < 3.6.6-1 | 3.6.6-1 |
| debian/rabbitmq-server(Debian:13) | < 3.6.6-1 | 3.6.6-1 |
| debian/rabbitmq-server(Debian:14) | < 3.6.6-1 | 3.6.6-1 |
| broadcom rabbitmq server | = 3.0.0 | No fix listed |
| broadcom rabbitmq server | = 3.0.1 | No fix listed |
| broadcom rabbitmq server | = 3.0.2 | No fix listed |
| broadcom rabbitmq server | = 3.0.3 | No fix listed |
| broadcom rabbitmq server | = 3.0.4 | No fix listed |
| broadcom rabbitmq server | = 3.1.0 | No fix listed |
| broadcom rabbitmq server | = 3.1.1 | No fix listed |
| broadcom rabbitmq server | = 3.1.2 | No fix listed |
| broadcom rabbitmq server | = 3.1.3 | No fix listed |
| broadcom rabbitmq server | = 3.1.4 | No fix listed |
| broadcom rabbitmq server | = 3.1.5 | No fix listed |
| broadcom rabbitmq server | = 3.2.0 | No fix listed |
| broadcom rabbitmq server | = 3.2.1 | No fix listed |
| broadcom rabbitmq server | = 3.2.2 | No fix listed |
| broadcom rabbitmq server | = 3.2.3 | No fix listed |
| broadcom rabbitmq server | = 3.2.4 | No fix listed |
| broadcom rabbitmq server | = 3.3.0 | No fix listed |
| broadcom rabbitmq server | = 3.3.1 | No fix listed |
| broadcom rabbitmq server | = 3.3.2 | No fix listed |
| broadcom rabbitmq server | = 3.3.3 | No fix listed |
| broadcom rabbitmq server | = 3.3.4 | No fix listed |
| broadcom rabbitmq server | = 3.3.5 | No fix listed |
Show 54 more
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom rabbitmq server | = 3.4.0 | No fix listed |
| broadcom rabbitmq server | = 3.4.1 | No fix listed |
| broadcom rabbitmq server | = 3.4.2 | No fix listed |
| broadcom rabbitmq server | = 3.4.3 | No fix listed |
| broadcom rabbitmq server | = 3.4.4 | No fix listed |
| broadcom rabbitmq server | = 3.5.0 | No fix listed |
| broadcom rabbitmq server | = 3.5.1 | No fix listed |
| broadcom rabbitmq server | = 3.5.2 | No fix listed |
| broadcom rabbitmq server | = 3.5.3 | No fix listed |
| broadcom rabbitmq server | = 3.5.6 | No fix listed |
| pivotal software rabbitmq | = 3.5.4 | No fix listed |
| pivotal software rabbitmq | = 3.5.5 | No fix listed |
| pivotal software rabbitmq | = 3.5.7 | No fix listed |
| pivotal software rabbitmq | = 3.6.0 | No fix listed |
| pivotal software rabbitmq | = 3.6.1 | No fix listed |
| pivotal software rabbitmq | = 3.6.2 | No fix listed |
| pivotal software rabbitmq | = 3.6.3 | No fix listed |
| pivotal software rabbitmq | = 3.6.4 | No fix listed |
| pivotal software rabbitmq | = 3.6.5 | No fix listed |
| pivotal software rabbitmq | = 1.5.0 | No fix listed |
| pivotal software rabbitmq | = 1.5.1 | No fix listed |
| pivotal software rabbitmq | = 1.5.2 | No fix listed |
| pivotal software rabbitmq | = 1.5.3 | No fix listed |
| pivotal software rabbitmq | = 1.5.4 | No fix listed |
| pivotal software rabbitmq | = 1.5.5 | No fix listed |
| pivotal software rabbitmq | = 1.5.6 | No fix listed |
| pivotal software rabbitmq | = 1.5.7 | No fix listed |
| pivotal software rabbitmq | = 1.5.8 | No fix listed |
| pivotal software rabbitmq | = 1.5.9 | No fix listed |
| pivotal software rabbitmq | = 1.5.10 | No fix listed |
| pivotal software rabbitmq | = 1.5.11 | No fix listed |
| pivotal software rabbitmq | = 1.5.12 | No fix listed |
| pivotal software rabbitmq | = 1.5.13 | No fix listed |
| pivotal software rabbitmq | = 1.5.14 | No fix listed |
| pivotal software rabbitmq | = 1.5.15 | No fix listed |
| pivotal software rabbitmq | = 1.5.17 | No fix listed |
| pivotal software rabbitmq | = 1.5.18 | No fix listed |
| pivotal software rabbitmq | = 1.6.0 | No fix listed |
| pivotal software rabbitmq | = 1.6.1 | No fix listed |
| pivotal software rabbitmq | = 1.6.2 | No fix listed |
| pivotal software rabbitmq | = 1.6.3 | No fix listed |
| pivotal software rabbitmq | = 1.6.4 | No fix listed |
| pivotal software rabbitmq | = 1.6.5 | No fix listed |
| pivotal software rabbitmq | = 1.6.6 | No fix listed |
| pivotal software rabbitmq | = 1.6.7 | No fix listed |
| pivotal software rabbitmq | = 1.6.8 | No fix listed |
| pivotal software rabbitmq | = 1.6.9 | No fix listed |
| pivotal software rabbitmq | = 1.6.10 | No fix listed |
| pivotal software rabbitmq | = 1.7.0 | No fix listed |
| pivotal software rabbitmq | = 1.7.2 | No fix listed |
| pivotal software rabbitmq | = 1.7.3 | No fix listed |
| pivotal software rabbitmq | = 1.7.4 | No fix listed |
| pivotal software rabbitmq | = 1.7.5 | No fix listed |
| pivotal software rabbitmq | = 1.7.6 | No fix listed |
References
- Debian Security Tracker CVE-2016-9877 vendor-advisory
- DSA-3761 vendor-advisory
- 95065 vdb-entry
- pivotal.io mitigation vendor-advisory
- support.hpe.com
- bugs.debian.org issue-tracking