PT-2018-18394 · Apache · Apache Qpid Broker-J

Published 2018-06-19 · Updated 2018-10-16 · CVE-2018-8030

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache Qpid Broker-J versions 7.0.0 through 7.0.4 Apache Qpid Broker-J versions prior to 7.1.0

Description: A Denial of Service issue was found when using AMQP protocols 0-8, 0-9, or 0-91 to publish messages with a size greater than the allowed maximum message size limit, which is 100MB by default. This causes the broker to crash. It is noted that AMQP protocols 0-10 and 1.0 are not affected.

Recommendations: For Apache Qpid Broker-J versions 7.0.0 through 7.0.4, update to version 7.1.0 or later to resolve the issue. For Apache Qpid Broker-J versions prior to 7.1.0, update to version 7.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the message size to the default limit of 100MB when using AMQP protocols 0-8, 0-9, or 0-91 to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-8030

GHSA-7XR3-RGWH-PW22

Affected Products

Apache Qpid Broker-J

References · 10

• https://osv.dev/vulnerability/CVE-2018-8030 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xr3-rgwh-pw22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8030 · Security Note
• https://github.com/apache/qpid-broker-j · Note
• https://github.com/apache/qpid-broker-j/commit/025b48f3193e2b10b1c41d2bc3bcfc9cfc238a27 · Note
• https://github.com/advisories/GHSA-7xr3-rgwh-pw22 · Note
• https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876%40%3Cusers.qpid.apache.org%3E · Note
• http://securitytracker.com/id/1041138 · Note
• https://issues.apache.org/jira/browse/QPID-8203 · Note
• https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876@%3Cusers.qpid.apache.org%3E · Note