CVE-2010-3083: Medium severity Apache qpid vulnerability
It was discovered that SSL connections to the MRG broker could easily be blocked. If a client or application initiated a connection to the MRG broker's listening SSL port, the client connection would block access to the port until the SSL handshake completes (or fails). If a client failed to proceed with it, then the thread was never freed to process other connections, denying service to other clients. Only SSL connections were affected by this issue, and SSL support is not enabled by default.
Other sources
sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3083?
CVE-2010-3083 has been classified as having medium severity due to its impact on SSL connection handling.
How do I fix CVE-2010-3083?
To fix CVE-2010-3083, upgrade to an unaffected version of Apache Qpid or Red Hat Enterprise MRG as specified in the vendor advisories.
What software is affected by CVE-2010-3083?
CVE-2010-3083 affects specific versions of Apache Qpid and Red Hat Enterprise MRG.
What is the potential impact of CVE-2010-3083?
The potential impact of CVE-2010-3083 is the blocking of SSL connections to the MRG broker, leading to denial of service.
Is there a workaround for CVE-2010-3083?
There are no known effective workarounds for CVE-2010-3083; the recommended solution is to apply updates.