Bug 1543717 (CVE-2018-1298)

Summary:	CVE-2018-1298 qpid-java: Incorrect implementation of some SASL mechanisms can allow a remote unauthenticated attacker to cause a denial of service
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, bhu, chazlett, esammons, hghasemb, iboverma, java-sig-commits, jross, kpalko, matt, mcressma, messaging-bugs, puntogil, rrajasek, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	qpid-java 7.0.1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-12 04:59:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1543718
Bug Blocks:	1543719

Description Sam Fowler 2018-02-09 05:12:13 UTC

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows an unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected.

The following Authentication Providers support PLAIN SAML and are affected:
- Plain
- PlainPasswordFile
- SimpleLDAP
- Base64MD5PasswordFile
- MD5
- SCRAM-SHA-256
- SCRAM-SHA-1

The following Authentication Providers support XOAUTH2 SAML and are affected:
- OAuth2

The current implementation of SASL mechanisms PLAIN and XOAUTH2 require from client to provide an initial response. PLAIN and XOAUTH2 sasl mechanism implementations should send challenge (empty bytes) if initial response is not provided.


Upstream Issue:

https://issues.apache.org/jira/browse/QPID-8046


Upstream Patches:

https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=de509dd
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=30ca170
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=4b9fb37


External References:

https://tools.ietf.org/html/rfc4616

Comment 1 Sam Fowler 2018-02-09 05:16:26 UTC

Created qpid-java tracking bugs for this issue:

Affects: fedora-all [bug 1543718]

Comment 2 Kurt Seifried 2018-02-09 16:33:43 UTC

Satellite 6 uses qpid-cpp, not qpid-java, so removing from affected.

Comment 3 Jason Shepherd 2018-02-12 04:41:28 UTC

The affected Java classes are not present in MRG-2, or MRG-M-3. They were added in version 7 of qpid-broker-j which is the upstream project.

Comment 4 Jason Shepherd 2018-02-12 04:43:30 UTC

JBoss A-MQ, and Fuse only contain the qpid client libraries, not the broker implementation.