CVE-2019-0200
published 2019-03-06CVE-2019-0200: A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to…
PriorityP345high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
3.82%
88.8th percentile
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | — | — |
| apache | qpid_broker-j | 6.0.0 – 7.0.6 | — |
| apache_software_foundation | apache_qpid_broker-j | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Input Validation in Apache Qpid Broker-J
ghsa·2019-03-07
CVE-2019-0200 [HIGH] CWE-20 Improper Input Validation in Apache Qpid Broker-J
Improper Input Validation in Apache Qpid Broker-J
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
OSV
Improper Input Validation in Apache Qpid Broker-J
osv·2019-03-07
CVE-2019-0200 [HIGH] Improper Input Validation in Apache Qpid Broker-J
Improper Input Validation in Apache Qpid Broker-J
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Red Hat
qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
vendor_redhat·2019-03-01·CVSS 7.5
CVE-2019-0200 [HIGH] CWE-20 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Package: qpid-java (Red Hat Enterprise MRG 3) - Not affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-1010189 mgetty: opening a specially crafted file leads to an infinite loop and DoS
bugzilla·2019-08-09·CVSS 5.5
CVE-2019-1010189 [MEDIUM] CVE-2019-1010189 mgetty: opening a specially crafted file leads to an infinite loop and DoS
CVE-2019-1010189 mgetty: opening a specially crafted file leads to an infinite loop and DoS
mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file.
External References:
https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/
Discussion:
Created mgetty tracking bugs for this issue:
Affects: fedora-29 [bug 1739376]
---
Created attachment 1652882
Upstream patch
---
Upstream patch for this issue (attached):
commit 0162663ed5f45209792995b54e36424334ee46da
Author: Gert Doering
Date: Thu Sep 6 23:14:49 2018 +0200
Fix invalid lseek() leading to infinite loop in g32pbm
Commit 3ab78bddf4 "cleaned up code", supposedly r
Bugzilla
CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
bugzilla·2019-03-04·CVSS 7.5
CVE-2019-0200 [HIGH] CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10).
Upstream issue:
https://issues.apache.org/jira/browse/QPID-8273
References:
https://seclists.org/oss-sec/2019/q1/152
Discussion:
Created qpid-java tracking bugs for this issue:
Affects: fedora-all [bug 1685180]
Bugzilla
CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service [fedora-all]
bugzilla·2019-03-04·CVSS 7.5
CVE-2019-0200 [HIGH] CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service [fedora-all]
CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affect
Bugzilla
CVE-2019-3831 vdsm: privilege escalation to root via systemd_run
bugzilla·2019-02-14·CVSS 6.7
CVE-2019-3831 [MEDIUM] CVE-2019-3831 vdsm: privilege escalation to root via systemd_run
CVE-2019-3831 vdsm: privilege escalation to root via systemd_run
vdsm v4.19 through v4.30.3 and v4.30.5 through v4.30.8 exposed a systemd_run() function to the vdsm system user, which could be abused to run arbitrary commands as root. This breaks the defense-in-depth of having a non-root vdsm system account. While not exploitable by attackers under normal circumstances, this flaw could lead to a compromise of services running under the vdsm account being escalated to a full root compromise.
Upstream fix:
https://gerrit.ovirt.org/#/c/97659/
Originally introduced by:
commit e56541ccb372e106eeb4fc3f7afc575f8dd32de2
Author: Francesco Romani
Date: Fri Apr 22 10:15:54 2016 +0200
supervdsm: expose systemd utilities
Removed by:
commit f85f0527f1421618714e89eee03ee2f0400a65ae
Author: France
http://www.securityfocus.com/bid/107215https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de%40%3Cusers.qpid.apache.org%3Ehttp://www.securityfocus.com/bid/107215https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de%40%3Cusers.qpid.apache.org%3E
2019-03-06
Published