Read the docs
TI-2015-00196 Aliases CVE-2015-0224GHSA-qrxf-m4mx-cp67

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of…

Priority MEDIUM 49CWE-19Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.

Why it matters now

EPSS 0.15119 96th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*up to 0.30VulnerableApache
  • cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:* Versions up to 0.30 Vulnerable ·Apache

Remediation

Red Hat 5 advisories

  • RHSA-2015:0708 Released 2015-03-19 · Red Hat rating Moderate
    qpid security and bug fix update
    • Red Hat MRG Messaging v.3 for RHEL-7 libdb-5.3.21-17.el7_0.1, libdb-cxx-5.3.21-17.el7_0.1, libdb-cxx-devel-5.3.21-17.el7_0.1 +15
  • RHSA-2015:0707 Released 2015-03-19 · Red Hat rating Moderate
    qpid security and bug fix update
    • Red Hat MRG Messaging for RHEL 6 Server v.3 python-qpid-0.22-19.el6, python-qpid-qmf-0.22-41.el6, qpid-cpp-0.22-51.el6 +13
  • RHSA-2015:0661 Released 2015-03-09 · Red Hat rating Moderate
    qpid-cpp security and bug fix update
    • Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 qpid-cpp-0.18-38.el6, qpid-cpp-client-0.18-38.el6, qpid-cpp-client-ssl-0.18-38.el6 +2
    • Red Hat MRG Messaging for RHEL 6 Server v.2 qpid-cpp-0.18-38.el6, qpid-cpp-client-0.18-38.el6, qpid-cpp-client-devel-0.18-38.el6 +10
Show 2 more Red Hat advisories
  • RHSA-2015:0660 Released 2015-03-09 · Red Hat rating Moderate
    qpid-cpp security and bug fix update
    • Red Hat MRG Messaging v.2 for RHEL-7 qpid-cpp-0.18-38.el7, qpid-cpp-client-0.18-38.el7, qpid-cpp-client-devel-0.18-38.el7 +9
  • RHSA-2015:0662 Released 2015-03-09 · Red Hat rating Moderate
    qpid-cpp security and bug fix update
    • Red Hat MRG Messaging for RHEL 5 Server v.2 qpid-cpp-client-0.18-38.el5_10, qpid-cpp-client-0.18-38.el5_10.i386, qpid-cpp-client-devel-0.18-38.el5_10 +22

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)AffectedNo fix planned: Will not fix
Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2Fixed RHSA-2015:0661
Red Hat MRG Messaging for RHEL 5 Server v.2Fixed RHSA-2015:0662
Red Hat MRG Messaging for RHEL 6 Server v.2Fixed RHSA-2015:0661
Red Hat MRG Messaging for RHEL 6 Server v.3Fixed RHSA-2015:0707
Red Hat MRG Messaging v.2 for RHEL-7Fixed RHSA-2015:0660
Red Hat MRG Messaging v.3 for RHEL-7Fixed RHSA-2015:0708
Red Hat Satellite 6.2Fixed—
Red Hat Satellite Capsule 6.2Fixed—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-0224
  2. 2026-10-03 Alias added: GHSA-qrxf-m4mx-cp67

References

Patch 1

Advisory 9

Other 1

  • TI-2019-00196 While investigating bug PROTON-2014, we discovered that under some circumstances Apache… CVSS 3.1HIGH 7.4
  • TI-2011-03194 Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster… CVSS 2.0HIGH 7.5
  • TI-2015-00175 The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to… CVSS 3.0MEDIUM 6.5
  • TI-2012-03788 The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag… CVSS 2.0MEDIUM 6.8
  • TI-2012-03801 Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid… CVSS 2.0MEDIUM 5.0
  • TI-2015-00195 Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to… CVSS 2.0MEDIUM 5.0
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences