Bug 1409748 (CVE-2016-9877)

Summary: CVE-2016-9877 rabbitmq: MQTT connection authentication succeeds with empty password
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aortega, apevec, ayoung, chrisw, cvsbot-xmlrpc, erlang, hubert.plociniczak, jeckersb, jjoyce, josh, jpadman, jschluet, kbasil, kiyyappa, lemenkov, lhh, lpeer, markmc, plemenko, rbryant, rjones, sclewis, sisharma, srevivo, s, tdecacqu
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RabbitMQ 3.5.8, RabbitMQ 3.6.6 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-04-13 02:40:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1409749, 1409750    
Bug Blocks: 1409752    

Description Martin Prpič 2017-01-03 08:52:59 UTC
It was found that RabbitMQ's MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Comment 1 Martin Prpič 2017-01-03 08:53:21 UTC
External References:

https://pivotal.io/security/cve-2016-9877

Comment 2 Martin Prpič 2017-01-03 08:54:09 UTC
Created rabbitmq-server tracking bugs for this issue:

Affects: epel-all [bug 1409749]
Affects: fedora-all [bug 1409750]

Comment 7 Peter Lemenkov 2017-12-06 12:31:27 UTC
Indeed we don't use MQTT in our OpenStack configuration, so it was decided that the impact of this issue is negligibly low.

It's possible to backport the fix to OSP10 though.