CVE-2018-8030: Input Validation
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Other sources
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.x before 7.1.0 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.qpid:apache-qpid-broker-jto a version that resolves this vulnerability.Fixed in 7.1.0 - Upgrade
Upgrade
Apache Qpid Broker-Jto a version that resolves this vulnerability.Fixed in 7.1.0 - Configuration
Configure the broker's allowed maximum message size limit (default 100MB) so that AMQP message publish operations using protocols 0-8, 0-9, or 0-91 cannot exceed the maximum allowed size.
Apache Qpid Broker-J allowed maximum message size limit = <=100MB by default (ensure publish message size does not exceed configured maximum) - Operational
After applying the upgrade and/or message-size limit configuration, restart the affected broker instances that may have crashed due to the vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-8030?
CVE-2018-8030 is classified as a Denial of Service vulnerability.
How do I fix CVE-2018-8030?
To remediate CVE-2018-8030, upgrade to Apache Qpid Broker-J version 7.1.0 or later.
What versions are affected by CVE-2018-8030?
CVE-2018-8030 affects Apache Qpid Broker-J versions 7.0.0 through 7.0.4.
What happens if I exploit CVE-2018-8030?
Exploitation of CVE-2018-8030 can cause the broker to crash when oversized messages are published.
Which AMQP protocols are impacted by CVE-2018-8030?
CVE-2018-8030 impacts AMQP protocols 0-8, 0-9, and 0-91.