Description
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qpid-cpp | No fix yet | — |
References
- apache-qpid-cve20143629-info-disc(98575) vdb-entry
- 20141107 CVE-2014-3629: Apache Qpid's qpidd can be induced to make http requests mailing-list
- 71004 vdb-entry
- http://packetstormsecurity.com/files/129034/Apache-Qpid-0.30-Induced-HTTP-Requests.html
- 62235 third-party-advisory