Bug 1543717 (CVE-2018-1298) - CVE-2018-1298 qpid-java: Incorrect implementation of some SASL mechanisms can allow a remote unauthenticated attacker to cause a denial of service
Summary: CVE-2018-1298 qpid-java: Incorrect implementation of some SASL mechanisms can...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-1298
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1543718
Blocks: 1543719
TreeView+ depends on / blocked
 
Reported: 2018-02-09 05:12 UTC by Sam Fowler
Modified: 2021-02-17 00:50 UTC (History)
15 users (show)

Fixed In Version: qpid-java 7.0.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-02-12 04:59:43 UTC


Attachments (Terms of Use)

Description Sam Fowler 2018-02-09 05:12:13 UTC
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows an unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected.

The following Authentication Providers support PLAIN SAML and are affected:
- Plain
- PlainPasswordFile
- SimpleLDAP
- Base64MD5PasswordFile
- MD5
- SCRAM-SHA-256
- SCRAM-SHA-1

The following Authentication Providers support XOAUTH2 SAML and are affected:
- OAuth2

The current implementation of SASL mechanisms PLAIN and XOAUTH2 require from client to provide an initial response. PLAIN and XOAUTH2 sasl mechanism implementations should send challenge (empty bytes) if initial response is not provided.


Upstream Issue:

https://issues.apache.org/jira/browse/QPID-8046


Upstream Patches:

https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=de509dd
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=30ca170
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=4b9fb37


External References:

https://tools.ietf.org/html/rfc4616

Comment 1 Sam Fowler 2018-02-09 05:16:26 UTC
Created qpid-java tracking bugs for this issue:

Affects: fedora-all [bug 1543718]

Comment 2 Kurt Seifried 2018-02-09 16:33:43 UTC
Satellite 6 uses qpid-cpp, not qpid-java, so removing from affected.

Comment 3 Jason Shepherd 2018-02-12 04:41:28 UTC
The affected Java classes are not present in MRG-2, or MRG-M-3. They were added in version 7 of qpid-broker-j which is the upstream project.

Comment 4 Jason Shepherd 2018-02-12 04:43:30 UTC
JBoss A-MQ, and Fuse only contain the qpid client libraries, not the broker implementation.


Note You need to log in before you can comment on or make changes to this bug.