REDHAT-BUG-747078: Medium severity apache qpid vulnerability
A flaw was found in qpid where it would accept any password or SASL mechanism, provided the remote user knew a valid cluster username. This would give a malicious remote attacker unauthorized access to the cluster where they would be able to receive replicated messages to the cluster, be able to send any cluster message, mark any present message as consumed, run any job on the cluster, and also view/modify/create other users' jobs. Only cluster messages and internal qpid/MRG configuration is accessible to the remote attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-747078?
The severity of REDHAT-BUG-747078 is classified as critical due to the potential for unauthorized access to the cluster.
How do I fix REDHAT-BUG-747078?
To fix REDHAT-BUG-747078, you should update Apache Qpid to the latest patched version that addresses this vulnerability.
What are the implications of REDHAT-BUG-747078?
The implications of REDHAT-BUG-747078 include unauthorized access to clustered messages and potential data compromise.
Who is affected by REDHAT-BUG-747078?
Users of Apache Qpid versions that are vulnerable to this flaw are affected by REDHAT-BUG-747078.
What kind of attack does REDHAT-BUG-747078 enable?
REDHAT-BUG-747078 enables a malicious remote attacker to gain unauthorized access to the cluster using a valid username.