Skip to main content

Qpid Broker J CVE-2018-8030

HIGH
Improper Input Validation (CWE-20)
2018-06-20 security@apache.org
Denial Of Service Apache Qpid Broker J
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 20, 2018 - 01:29 nvd
HIGH 7.5

DescriptionNVD

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.

AnalysisAI

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected. Affected products include: Apache Qpid Broker-J.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Qpid Broker J

View all
CVE-2017-15702 CRITICAL
9.8 Dec 01

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on differ
CVE-2016-4432 CRITICAL
9.1 Jun 01

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to b
CVE-2017-15701 HIGH
7.5 Dec 01

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame si
CVE-2016-8741 HIGH
7.5 May 15

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth
CVE-2019-0200 HIGH
7.5 Mar 06

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which all
CVE-2016-3094 MEDIUM
5.9 Jun 01

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allow
CVE-2018-1298 MEDIUM
5.9 Feb 09

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connect

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2018-8030 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy