CVE-2016-8741

CVE-2016-8741: vulnerability in Apache Qpid Broker-J

Published · Updated

Follow this CVE+ Monitor Apache Qpid Broker-J+ Monitor org.apache.qpid:qpid-broker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.4%
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
Affected products
Apache Software Foundation · Apache Qpid Broker-J
Related CVEs — Apache Qpid Broker-J

In the same product, most dangerous first.

CVE-2017-15702—CVE-2017-15702EPSS 6.2%CVE-2017-15701—CVE-2017-15701EPSS 4.4%CVE-2019-0200—CVE-2019-0200EPSS 3.8%CVE-2018-8030—CVE-2018-8030EPSS 3.8%CVE-2018-1298—CVE-2018-1298EPSS 2.3%CVE-2026-68073HIGHApache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflowEPSS 0.8%