Description
The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | PyYAML | 3.08-5.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | classads +2 | 1.0.8-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor +2 | 7.4.4-0.16.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-job-hooks +1 | 1.4-5.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-low-latency | 1.1-0.2.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-vm-gahp | 7.4.4-0.16.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby +1 | 3.6-6.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby-base-db | 1.4-5.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | condor-wallaby-tools +1 | 3.6-6.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | cumin | 0.1.4369-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | libyaml +1 | 0.1.2-4.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | mrg-grid-docs | 1.3-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | mrg-release | 1.3-2.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | python-condorec2e +2 | 1.1-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | python-psycopg2 +1 | 2.0.14-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | python-qmf | 0.7.946106-13.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | python-qpid | 0.7.946106-14.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qmf +12 | 0.7.946106-17.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qpid-java +4 | 0.7.946106-11.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | qpid-tests | 0.7.946106-1.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | rhm-docs | 0.7.946106-8.el4 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-qmf +3 | 0.7.946106-17.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-qpid | 0.7.946106-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-rhubarb | 0.2.7-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | ruby-sqlite3 | 1.2.4-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | saslwrapper +3 | 0.1.934605-2.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | sesame | 0.7.4297-2.el5 | RHSA-2010:0774, RHSA-2010:0773 |
| Red Hat MRG 1 | spqr-gen +1 | 0.3.2-1.el5 | RHSA-2010:0773 |
| Red Hat MRG 1 | wallaby +2 | 0.9.18-2.el5 | RHSA-2010:0773 |
Advisories 2
- RHSA-2010:0774 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging and Grid Version 1.3 Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0773 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging and Grid Version 1.3 Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0774 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=642373
- ADV-2010-2684 vdb-entry
- http://svn.apache.org/viewvc?revision=785788&view=revision
- 41812 third-party-advisory
- 41710 third-party-advisory
- RHSA-2010:0773 vendor-advisory