https://bugzilla.redhat.com/show_bug.cgi?id=1685179
Bug ID: 1685179
Summary: CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10
commands resulting in a Denial of Service
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190301,reported=20190301,sou
rce=oss-security,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:
N/S:U/C:N/I:N/A:H,cwe=CWE-20,fedora-all/qpid-java=affe
cted,mrg-m-3/qpid-java=notaffected
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: esammons(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jross(a)redhat.com, mcressma(a)redhat.com,
messaging-bugs(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com
Target Milestone: ---
Classification: Other
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions
6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to
crash the broker instance by sending specially crafted commands using AMQP
protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10).
Upstream issue:
https://issues.apache.org/jira/browse/QPID-8273
References:
https://seclists.org/oss-sec/2019/q1/152
--
You are receiving this mail because:
You are on the CC list for the bug.