GitHub Advisoryadvisory · Maven

GHSA-jj9h-mwhq-8vhm Improper Input Validation in org.apache.qpid:qpid-broker

MEDIUM Published 2018-10-16 Modified 2023-05-22 Official page ↗
Aliases
CVE-2016-3094
Ecosystem
Maven
Packages
org.apache.qpid:qpid-broker
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-287
Reviewed
2020-06-16

Affected packages

• Maven org.apache.qpid:qpid-broker: < 6.0.3 → fixed in 6.0.3

Description

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

Related

Alias · CVE (1)

  • CVE-2016-3094 PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-287 Improper Authentication weakness

References