Skip to main content

Qpid CVE-2015-5164

HIGH
Deserialization of Untrusted Data (CWE-502)
2017-10-18 secalert@redhat.com
7.2
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 18, 2017 - 16:29 cve.org
HIGH 7.2

DescriptionCVE.org

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.

AnalysisAI

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp. Affected products include: Pulpproject Qpid.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Qpid

View all
CVE-2015-0224 HIGH
7.5 Oct 30

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted

CVE-2019-0223 HIGH
7.4 Apr 23

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27

CVE-2012-4446 MEDIUM
6.8 Mar 14

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP c

CVE-2012-2145 MEDIUM
5.0 Sep 28

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to ca

CVE-2013-1909 MEDIUM
5.8 Aug 23

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subjec

CVE-2012-4460 MEDIUM
5.0 Mar 14

The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote

CVE-2012-4458 MEDIUM
5.0 Mar 14

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consu

CVE-2015-0223 MEDIUM
5.0 Feb 02

Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd

CVE-2012-4459 MEDIUM
5.0 Mar 14

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote att

CVE-2012-3467 MEDIUM
5.0 Aug 27

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AM

CVE-2014-3629 MEDIUM
4.3 Nov 17

XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause

Share

CVE-2015-5164 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy