AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication

KRITISCH 9.1CVE-2016-4432 · GHSA-q66c-h853-gqw2 · Published 01/06/2016 · updated 17/06/2026

Kurz gesagt

CVE-2016-4432 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol, org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol, qpid broker-j (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 8.9%, höher als bei 95.2% aller Schwachstellen.
Abhilfe: auf 6.0.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol Maven	`< 6.0.3`	`6.0.3`
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol Maven	`< 6.0.3`	`6.0.3`
qpid broker-j apache	`< 6.0.3`	`6.0.3`

Description

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-4432 · ADVISORY
apache/qpid-broker-j · PACKAGE
issues.apache.org/jira/browse/QPID-7257 · WEB
svn.apache.org/viewvc · WEB
svn.apache.org/viewvc · WEB
mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E · WEB
packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html · WEB
securityfocus.com/archive/1/538508/100/0/threaded · Third Party Advisory
securitytracker.com/id/1035983 · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free