CVE-2012-4446
Fixed in a distro release EPSS 5%
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Products: apache qpid
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.qpid:qpid-client | 0.20 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat enterprise mrg 2 | cumin-messaging | 0:0.1.1-2.el5 |
| Red Hat enterprise mrg 2 | mrg-release | 0:2.3.0-1.el5 |
| Red Hat enterprise mrg 2 | python-qpid | 0:0.18-4.el5 |
| Red Hat enterprise mrg 2 | python-qpid-qmf | 0:0.18-15.el5 |
| Red Hat enterprise mrg 2 | python-saslwrapper | 0:0.18-1.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-client | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-client-devel | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-client-devel-docs | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-client-rdma | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-client-ssl | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-mrg | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-mrg-debuginfo | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-cluster | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-devel | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-rdma | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-ssl | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-store | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-cpp-server-xml | 0:0.18-14.el5 |
| Red Hat enterprise mrg 2 | qpid-java | 0:0.18-7.el5 |
| Red Hat enterprise mrg 2 | qpid-java-client | 0:0.18-7.el5 |
| Red Hat enterprise mrg 2 | qpid-java-common | 0:0.18-7.el5 |
| Red Hat enterprise mrg 2 | qpid-java-example | 0:0.18-7.el5 |
| Red Hat enterprise mrg 2 | qpid-jca | 0:0.18-8.el5 |
| Red Hat enterprise mrg 2 | qpid-jca-xarecovery | 0:0.18-8.el5 |
| Red Hat enterprise mrg 2 | qpid-qmf | 0:0.18-15.el5 |
| Red Hat enterprise mrg 2 | qpid-qmf-debuginfo | 0:0.18-15.el5 |
| Red Hat enterprise mrg 2 | qpid-qmf-devel | 0:0.18-15.el5 |
| Red Hat enterprise mrg 2 | qpid-tests | 0:0.18-2.el5 |
| Red Hat enterprise mrg 2 | qpid-tools | 0:0.18-8.el5 |
| Red Hat enterprise mrg 2 | rhm-docs | 0:0.18-2.el5 |
| Red Hat enterprise mrg 2 | ruby-qpid-qmf | 0:0.18-15.el5 |
| Red Hat enterprise mrg 2 | ruby-saslwrapper | 0:0.18-1.el5 |
| Red Hat enterprise mrg 2 | saslwrapper | 0:0.18-1.el5 |
| Red Hat enterprise mrg 2 | saslwrapper-debuginfo | 0:0.18-1.el5 |
| Red Hat enterprise mrg 2 | saslwrapper-devel | 0:0.18-1.el5 |
| Red Hat enterprise mrg 2 computenode el6 | mrg-release | 0:2.3.0-1.el6 |
| Red Hat enterprise mrg 2 computenode el6 | python-qpid | 0:0.18-4.el6 |
| Red Hat enterprise mrg 2 computenode el6 | python-qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 computenode el6 | python-saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-client | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-client-ssl | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-debuginfo | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-server | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-server-ssl | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-qmf-debuginfo | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-tests | 0:0.18-2.el6 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-tools | 0:0.18-8.el6 |
| Red Hat enterprise mrg 2 computenode el6 | ruby-qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 computenode el6 | ruby-saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 computenode el6 | rubygem-rake | 0:0.8.7-2.1.el6 |
| Red Hat enterprise mrg 2 computenode el6 | rubygems | 0:1.8.16-1.el6 |
| Red Hat enterprise mrg 2 computenode el6 | saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 computenode el6 | saslwrapper-debuginfo | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 computenode el6 | saslwrapper-devel | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 computenode el6 | xerces-c | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xerces-c-debuginfo | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xerces-c-devel | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xerces-c-doc | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xqilla | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xqilla-debuginfo | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xqilla-devel | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 computenode el6 | xqilla-doc | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 server el6 | cumin-messaging | 0:0.1.1-2.el6 |
| Red Hat enterprise mrg 2 server el6 | mrg-release | 0:2.3.0-1.el6 |
| Red Hat enterprise mrg 2 server el6 | python-qpid | 0:0.18-4.el6 |
| Red Hat enterprise mrg 2 server el6 | python-qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 server el6 | python-saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-devel | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-devel-docs | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-rdma | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-ssl | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-debuginfo | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-cluster | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-devel | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-rdma | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-ssl | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-store | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-xml | 0:0.18-14.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-java | 0:0.18-7.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-client | 0:0.18-7.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-common | 0:0.18-7.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-example | 0:0.18-7.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-jca | 0:0.18-8.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-jca-xarecovery | 0:0.18-8.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf-debuginfo | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf-devel | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-tests | 0:0.18-2.el6 |
| Red Hat enterprise mrg 2 server el6 | qpid-tools | 0:0.18-8.el6 |
| Red Hat enterprise mrg 2 server el6 | rhm-docs | 0:0.18-2.el6 |
| Red Hat enterprise mrg 2 server el6 | ruby-qpid-qmf | 0:0.18-15.el6 |
| Red Hat enterprise mrg 2 server el6 | ruby-saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 server el6 | rubygem-rake | 0:0.8.7-2.1.el6 |
| Red Hat enterprise mrg 2 server el6 | rubygems | 0:1.8.16-1.el6 |
| Red Hat enterprise mrg 2 server el6 | saslwrapper | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 server el6 | saslwrapper-debuginfo | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 server el6 | saslwrapper-devel | 0:0.18-1.el6_3 |
| Red Hat enterprise mrg 2 server el6 | xerces-c | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 server el6 | xerces-c-debuginfo | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 server el6 | xerces-c-devel | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 server el6 | xerces-c-doc | 0:3.0.1-20.el6 |
| Red Hat enterprise mrg 2 server el6 | xqilla | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 server el6 | xqilla-debuginfo | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 server el6 | xqilla-devel | 0:2.2.3-8.el6 |
| Red Hat enterprise mrg 2 server el6 | xqilla-doc | 0:2.2.3-8.el6 |
| Ubuntu 16.04 LTS | qpid-cpp | no fix |