GHSA-q66c-h853-gqw2CriticalCVSS 9.1

AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication

Published
October 16, 2018
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2016-4432 →

📋 Description

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

🎯 Affected products2

  • maven/org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol:< 6.0.3
  • maven/org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol:< 6.0.3

🔗 References (7)