CVE-2009-5005: Medium severity apache qpid vulnerability
It was reported [1] that Apache QPID would crash when receiving data from a client that is not valid AMQP data, resulting in a shut down of the cluster rather than the client being disconnected. This was corrected upstream by r785788 [2].
[1] https://bugzilla.redhat.com/showbug.cgi?id=506580 [2] http://svn.apache.org/viewvc?revision=785788&view=revision
Other sources
The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5005?
CVE-2009-5005 has a severity rating that indicates it can cause a crash in Apache Qpid when invalid data is received.
How do I fix CVE-2009-5005?
To fix CVE-2009-5005, update to the latest version of Apache Qpid as corrected in upstream revision r785788.
Which versions of Apache Qpid are affected by CVE-2009-5005?
CVE-2009-5005 affects Apache Qpid versions up to and including 0.5.
Can CVE-2009-5005 cause data loss?
CVE-2009-5005 itself does not directly cause data loss but leads to a crash that may disrupt service.
What impact does CVE-2009-5005 have on Apache Qpid clusters?
CVE-2009-5005 can result in a complete shutdown of the Apache Qpid cluster when invalid AMQP data is received.