Description
sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | qmf +10 | 0.5.752581-42.el4 | RHSA-2010:0757, RHSA-2010:0756 |
| Red Hat MRG 1 | qpidc-rdma +2 | 0.5.752581-42.el5 | RHSA-2010:0756 |
| Red Hat MRG 1 | rhm | 0.5.3206-36.el4 | RHSA-2010:0757, RHSA-2010:0756 |
Advisories 2
- RHSA-2010:0757 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging security and bug fix update 1.2.2 Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0756 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging security and bug fix update 1.2.2 Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0756 vendor-advisory
- [oss-security] 20101007 qpidd SSL connection DoS (CVE-2010-3083) mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=632657
- http://svn.apache.org/viewvc/qpid/trunk/qpid/cpp/src/qpid/sys/ssl/SslSocket.cpp?r1=790291&r2=790290&pathrev=790291&view=patch
- 41710 third-party-advisory
- RHSA-2010:0757 vendor-advisory