Red Hat Bugzilla – Bug 1164848
CVE-2014-3629 qpid-cpp: XXE vulnerability causes outgoing HTTP connections
Last modified: 2016-04-26 23:46:13 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-3629 to the following vulnerability: Name: CVE-2014-3629 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3629 Assigned: 20140514 Reference: 20141107 CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests Reference: http://www.securityfocus.com/archive/1/archive/1/533943/100/0/threaded Reference: http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html Reference: http://www.securityfocus.com/bid/71004 Reference: http://secunia.com/advisories/62235 Reference: http://xforce.iss.net/xforce/xfdb/98575 XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message. Upstream notes the following mitigations: If the XML exchange functionality is not required, the module in question need not be loaded at all. This can be done either by moving the module - named xml.so - out of the module directory, or by setting the --no-module-dir option and adding an explicit --load-module argument for every required module. Where the XML exchange functionality is required, authorisation may be enabled to prevent all but trusted users from creating or publishing to xml exchanges. A patch to correct this is available: https://svn.apache.org/viewvc?view=revision&revision=r1637402 https://issues.apache.org/jira/browse/QPID-6218 This has also been fixed in Fedora already: https://admin.fedoraproject.org/updates/FEDORA-2014-14564/qpid-cpp-0.26-12.fc19
The XML exchange type is an optional and dynamically-loaded module, where authorization may be enabled to prevent untrusted users from creating, or publishing to, XML exchanges. In order for this to be exploited it first needs to be enabled (non-default) and you must be an authenticated user. Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.