CVE-2018-8030: Input Validation
First published: Mon Jun 18 2018(Updated: )
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Qpid Broker-J | >=7.0.0<=7.0.4 | |
| maven/org.apache.qpid:apache-qpid-broker-j | >=7.0.0<7.1.0 | 7.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securitytracker.com/id/1041138
- https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876@%3Cusers.qpid.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2018-8030
- https://github.com/advisories/GHSA-7xr3-rgwh-pw22 (Advisory)
- https://github.com/apache/qpid-broker-j/commit/025b48f3193e2b10b1c41d2bc3bcfc9cfc238a27
- https://issues.apache.org/jira/browse/QPID-8203
- https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876%40%3Cusers.qpid.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2018-8030?
CVE-2018-8030 is classified as a Denial of Service vulnerability.
How do I fix CVE-2018-8030?
To remediate CVE-2018-8030, upgrade to Apache Qpid Broker-J version 7.1.0 or later.
What versions are affected by CVE-2018-8030?
CVE-2018-8030 affects Apache Qpid Broker-J versions 7.0.0 through 7.0.4.
What happens if I exploit CVE-2018-8030?
Exploitation of CVE-2018-8030 can cause the broker to crash when oversized messages are published.
Which AMQP protocols are impacted by CVE-2018-8030?
CVE-2018-8030 impacts AMQP protocols 0-8, 0-9, and 0-91.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7xr3-rgwh-pw22
- alias/CVE-2018-8030
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/description
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/author
- agent/references
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- vendor/apache
- canonical/apache qpid broker-j
- version/apache qpid broker-j/7.0.0
- version/apache qpid broker-j/7.0.4
- package-manager/maven