Description
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qpid-cpp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | cumin-messaging | 0.1.1-2.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | mrg-release | 2.3.0-1.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | python-qpid | 0.18-4.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-cpp | 0.18-14.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | qpid-cpp-mrg +12 | 0.18-14.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-java +3 | 0.18-7.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-jca +2 | 0.18-8.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-qmf +3 | 0.18-15.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | rhm-docs +1 | 0.18-2.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | rubygem-rake | 0.8.7-2.1.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | rubygems | 1.8.16-1.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | saslwrapper +3 | 0.18-1.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | xerces-c +2 | 3.0.1-20.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | xqilla +2 | 2.2.3-8.el6 | RHSA-2013:0562 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.qpid:qpid-client | < 0.20 | 0.20 | GHSA-mrgh-6x42-x6xf |
Advisories 2
- RHSA-2013:0561 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0562 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://issues.apache.org/jira/browse/QPID-4631
- RHSA-2013:0561 vendor-advisory
- RHSA-2013:0562 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=851355
- 52516 third-party-advisory