Red Hat Security AdvisoryRHSA-2012:1277
Red Hat Enterprise MRG Messaging 2.2 update
Released 2012-09-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- MRG Grid Execute Node for RHEL 5 Server v.2 mrg-release-2.2.0-1.el5
- MRG Grid for RHEL 5 Server v.2 mrg-release-2.2.0-1.el5
- MRG Management for RHEL 5 Server v.2 mrg-release-2.2.0-1.el5
- Red Hat MRG Messaging for RHEL 5 Server v.2 mrg-release-2.2.0-1.el5, python-qpid-0.14-11.el5, python-qpid-qmf-0.14-14.el5 +39
Fixes 2 records
Priority LOW 32
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.06394 · Published 2012-08-27 · Fixed in 0.17 CWE-287
Priority LOW 30
Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04236 · Published 2012-09-28 · Partial fix CWE-399
