[QPID-8039] [CVE-2017-15702] [Broker-J] HTTP Ports may be tricked into using the wrong authentication provider

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 0.18, 0.32
• Fix Version/s: qpid-java-6.0
• Component/s: Broker-J
• Assignee: Unassigned
• Reporter: Lorenz Quack
• Created: 16/Nov/17 15:25
• Updated: 30/Nov/17 17:31
• Resolved: 16/Nov/17 15:26

Description

In Qpid Broker-J 0.18..0.32 the when connecting to the HTTP port, it is possible to trick the port into using an authentication provider other than the one configured on the port. This becomes an issue if many authentication providers are configured and one offers less trust than another.

This was resolved in Qpid Broker-J v6.0.0 and above.

Issue Links

• links to: CVE-2017-15702