[
https://issues.apache.org/jira/browse/QPID-8203?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Alex Rudyy updated QPID-8203:
-----------------------------
Description:
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions
7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages
with size greater than allowed maximum message size limit (100MB by default).
The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not
affected.
Resolution:
Users of Broker-J versions 7.0.0-7.0.4 utilizing AMQP protocols 0-8, 0-9 or
0-91 for message publishing must upgrade to version 7.0.5 or later.
Mitigation:
If upgrade of the broker is not possible, the maximum message size limit can be
disabled by setting context variable "qpid.max_message_size" to "0" or any
negative value. The change can be made either directly in the broker
configuration file,
or by using management interfaces (for example, REST API) or by
using JVM option {{-Dqpid.max_message_size=0}}. A broker restart is required
for the change to take effect.
Alternatively, the support for AMQP protocols 0-8...0-91 can be removed on AMQP
ports.
The change can be made either directly in the broker configuration file
or by using management interfaces. An example of REST API call
restricting AMQP port to support only AMQP 1.0 and AMQP 0-10 using curl utility
is provided below:
{code:bash}
curl --user <user-name> -X POST -d '{"protocols":["AMQP_1_0","AMQP_0_10"]}' \
https://<broker host>:<broker port>/api/latest/port/<port name>
{code}
was:Maximum message size check needs to be improved
Summary: [Broker-J][AMQP 0-8...0-91] [CVE-2018-8030] Denial of Service
Vulnerability when AMQP 0-8...0-91 messages exceed maximum size limit (was:
[Broker-J][AMQP 0-8...0-91] Improve maximum message size check)
> [Broker-J][AMQP 0-8...0-91] [CVE-2018-8030] Denial of Service Vulnerability
> when AMQP 0-8...0-91 messages exceed maximum size limit
> -----------------------------------------------------------------------------------------------------------------------------------
>
> Key: QPID-8203
> URL: https://issues.apache.org/jira/browse/QPID-8203
> Project: Qpid
> Issue Type: Bug
> Components: Broker-J
> Affects Versions: qpid-java-broker-7.0.3, qpid-java-broker-7.0.2,
> qpid-java-broker-7.0.0, qpid-java-broker-7.0.1, qpid-java-broker-7.0.4
> Reporter: Alex Rudyy
> Assignee: Alex Rudyy
> Priority: Critical
> Fix For: qpid-java-broker-7.1.0, qpid-java-broker-7.0.5
>
>
> A Denial of Service vulnerability was found in Apache Qpid Broker-J versions
> 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages
> with size greater than allowed maximum message size limit (100MB by default).
> The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not
> affected.
> Resolution:
> Users of Broker-J versions 7.0.0-7.0.4 utilizing AMQP protocols 0-8, 0-9 or
> 0-91 for message publishing must upgrade to version 7.0.5 or later.
> Mitigation:
> If upgrade of the broker is not possible, the maximum message size limit can
> be disabled by setting context variable "qpid.max_message_size" to "0" or any
> negative value. The change can be made either directly in the broker
> configuration file,
> or by using management interfaces (for example, REST API) or by
> using JVM option {{-Dqpid.max_message_size=0}}. A broker restart is required
> for the change to take effect.
> Alternatively, the support for AMQP protocols 0-8...0-91 can be removed on
> AMQP ports.
> The change can be made either directly in the broker configuration file
> or by using management interfaces. An example of REST API call
> restricting AMQP port to support only AMQP 1.0 and AMQP 0-10 using curl
> utility is provided below:
> {code:bash}
> curl --user <user-name> -X POST -d '{"protocols":["AMQP_1_0","AMQP_0_10"]}' \
> https://<broker host>:<broker port>/api/latest/port/<port name>
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
