Description
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +5 | 7.6.5-0.14.el5 | RHSA-2012:0529, RHSA-2012:0528 |
| Red Hat MRG 2 | condor-plumage | 7.6.5-0.14.el6 | RHSA-2012:0528 |
| Red Hat MRG 2 | python-qpid | 0.14-6.el5 | RHSA-2012:0529 |
| Red Hat MRG 2 | qpid-cpp | 0.14-14.el6_2 | RHSA-2012:0528 |
| Red Hat MRG 2 | qpid-cpp-mrg +12 | 0.14-14.el5 | RHSA-2012:0529, RHSA-2012:0528 |
| Red Hat MRG 2 | qpid-java +3 | 0.14-3.el5 | RHSA-2012:0529, RHSA-2012:0528 |
| Red Hat MRG 2 | qpid-jca +3 | 0.14-9.el5 | RHSA-2012:0529, RHSA-2012:0528 |
| Red Hat MRG 2 | qpid-qmf +1 | 0.14-7.el6_2 | RHSA-2012:0529, RHSA-2012:0528 |
| Red Hat MRG 2 | qpid-tests | 0.14-1.el5 | RHSA-2012:0529 |
| Red Hat MRG 2 | qpid-tools | 0.14-2.el5 | RHSA-2012:0529 |
| Red Hat MRG 2 | sesame | 1.0-3.el5 | RHSA-2012:0529, RHSA-2012:0528 |
Advisories 2
- RHSA-2012:0528 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0529 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.1 security and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026