Red Hat Security Advisory

RHSA-2013:0561

Red Hat Enterprise MRG Messaging 2.3 security update

Released 2013-03-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

MRG Grid Execute Node for RHEL 5 Server v.2 mrg-release-2.3.0-1.el5
MRG Grid for RHEL 5 Server v.2 mrg-release-2.3.0-1.el5
MRG Management for RHEL 5 Server v.2 cumin-messaging-0.1.1-2.el5, mrg-release-2.3.0-1.el5
Red Hat MRG Messaging for RHEL 5 Server v.2 mrg-release-2.3.0-1.el5, python-qpid-0.18-4.el5, python-qpid-qmf-0.18-15.el5 +47

Fixes 3 records

TI-2012-03788 CVE-2012-4446 · GHSA-mrgh-6x42-x6xf

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag…

LOW 38

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authenticati…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04913 Published 2013-03-12 Partial fix · 0.20 CWE-287

TI-2012-03801 CVE-2012-4459 · GHSA-f4gr-qh9c-r8fg

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid…

LOW 35

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds r…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.09212 Published 2013-03-12 Partial fix CWE-189

TI-2012-03800 CVE-2012-4458 · GHSA-qggc-rjcq-ppj4

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a…

LOW 32

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.06355 Published 2013-03-12 Partial fix CWE-189