Description
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | mrg-release | 2.2.0-1.el5 | RHSA-2012:1279, RHSA-2012:1277 |
| Red Hat MRG 2 | python-qpid | 0.14-11.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-cpp | 0.14-22.el6_3 | RHSA-2012:1279 |
| Red Hat MRG 2 | qpid-cpp-mrg +12 | 0.14-22.el5 | RHSA-2012:1279, RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-jca +5 | 0.18-2.el5 | RHSA-2012:1279, RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-qmf +3 | 0.14-14.el5 | RHSA-2012:1279, RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-tools | 0.14-6.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | xerces-c +2 | 3.0.1-20.el6 | RHSA-2012:1279 |
| Red Hat MRG 2 | xqilla +2 | 2.2.3-8.el6 | RHSA-2012:1279 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.qpid:qpid-parent | < 0.17 | 0.17 | GHSA-phw8-fw9g-v3xc |
Advisories 2
- RHSA-2012:1279 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1277 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- http://svn.apache.org/viewvc?view=revision&revision=1352992
- 50186 third-party-advisory
- 54954 vdb-entry
- RHSA-2012:1279 vendor-advisory
- https://issues.apache.org/jira/browse/QPID-3849
- apache-qpid-broker-sec-bypass(77568) vdb-entry
- RHSA-2012:1277 vendor-advisory
- 50698 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=836276
- [oss-security] 20120809 CVE-2012-3467: Unauthorized access (authentication bypass) from client to broker due to use of NullAuthenticator in shadow connections mailing-list