CVE-2016-4432: Qpid broker plugins amqp 0 8 protocol AMQP 0-8, 0-9, 0-91, And Vulnerability
CRITICALCVE-2016-4432 is a CRITICAL (CVSS 9.1) amqp 0-8, 0-9, 0-91, and vulnerability (CWE-287: Improper Authentication) affecting Qpid broker plugins amqp 0 8 protocol libraries in the Maven ecosystem. The issue involves amqp 0-8, 0-9, 0-91, and 0-10 connection handling in apache qpid java before 6.0.3 might allow remote attackers to bypass authentication. Remediation is available by upgrading affected packages to version 6.0.3.
CVE-2016-4432 at a Glance
Security Impact
CVSS: 9.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
How to Fix CVE-2016-4432
To remediate this vulnerability, upgrade all affected Qpid broker plugins amqp 0 8 protocol dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.apache.qpid</groupId>
<artifactId>qpid-broker-plugins-amqp-0-8-protocol</artifactId>
<version>6.0.3</version>
</dependency><dependency>
<groupId>org.apache.qpid</groupId>
<artifactId>qpid-broker-plugins-amqp-1-0-protocol</artifactId>
<version>6.0.3</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.apache.qpidHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2016-4432, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.apache.qpidAnalyze the terminal output to locate any version of Qpid broker plugins amqp 0 8 protocol in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.0.3), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.apache.qpid command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Qpid broker plugins amqp 0 8 protocol, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2016-4432 Affected Qpid broker plugins amqp 0 8 protocol Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol
|
Maven |
< 6.0.3
|
6.0.3
|
|
org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol
|
Maven |
< 6.0.3
|
6.0.3
|
References
Frequently Asked Questions
What is CVE-2016-4432?
Which Qpid broker plugins amqp 0 8 protocol versions are affected?
What version fixes CVE-2016-4432?
Is qpid-broker-plugins-amqp-0-8-protocol affected?
Is qpid-broker-plugins-amqp-1-0-protocol affected?
What is the CVSS score of CVE-2016-4432?
What CWE is associated with CVE-2016-4432?
How can I check Maven dependencies for CVE-2016-4432?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-q66c-h853-gqw2",
"modified" : "2023-01-18T06:20:33Z",
"published" : "2018-10-16T19:49:48Z",
"aliases" : [ "CVE-2016-4432" ],
"summary" : "AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication",
"details" : "The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "6.0.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "6.0.3"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-4432"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/apache/qpid-broker-j"
}, {
"type" : "WEB",
"url" : "https://issues.apache.org/jira/browse/QPID-7257"
}, {
"type" : "WEB",
"url" : "https://svn.apache.org/viewvc?view=revision&revision=1743161"
}, {
"type" : "WEB",
"url" : "https://svn.apache.org/viewvc?view=revision&revision=1743393"
}, {
"type" : "WEB",
"url" : "http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E"
}, {
"type" : "WEB",
"url" : "http://packetstormsecurity.com/files/137216/Apache-Qpid-Java-Broker-6.0.2-Authentication-Bypass.html"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-287" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2020-06-16T21:51:10Z",
"nvd_published_at" : "2016-06-01T20:59:00Z"
}
}