TI-2017-11476 Aliases CVE-2017-15702 GHSA-269m-695x-j34p

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different…

MEDIUM 51Published 2017-12-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected.

Why it matters now

EPSS 0.06214 93rd percentileScored 2026-11-07

Fix Partial org.apache.qpid:qpid-broker (Maven): 6.0.0Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Qpid Broker-J	0.18 through 0.32	—	No fix listed	CNA
—	org.apache.qpid:qpid-broker (Maven)	0.18 to before 6.0.0	6.0.0	Patch available	GHSA-269m-695x-j34p

Apache Qpid Broker-J VendorApache Affected 0.18 through 0.32 Fixed in — No fix listed CNA
org.apache.qpid:qpid-broker (Maven) Vendor— Affected 0.18 to before 6.0.0 Fixed in 6.0.0 Patch available GHSA-269m-695x-j34p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:qpid_broker-j::::::::	0.18 – 0.32	Vulnerable	Apache

cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:* Versions 0.18 – 0.32 Vulnerable ·Apache

Remediation

Fix · GHSA-269m-695x-j34p org.apache.qpid:qpid-broker (Maven) Fixed in 6.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise MRG 2	Affected	No fix planned: Will not fix
Red Hat Enterprise MRG 3	Affected	No fix planned: Will not fix
Red Hat Satellite 6	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2017-15702
2026-10-03 Alias added: GHSA-269m-695x-j34p

References

Advisory 4

Other 3

TI-2016-03808 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3… CVSS 3.1CRITICAL 9.1
TI-2026-62463 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication CVSS 3.1CRITICAL 9.8
TI-2016-07198 Information disclosure in Apache Qpid Broker-J CVSS 3.1HIGH 7.5
TI-2026-47855 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
TI-2026-47854 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow CVSS 3.1HIGH 7.5
TI-2026-47849 Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication CVSS 3.1HIGH 7.5

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences