CVE-2012-4446 Improper Authentication in Apache Qpid

What is CVE-2012-4446?

CVE-2012-4446 is a medium-severity authentication bypass vulnerability in n/a, published on 12 Mar 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.

Weakness: CWE-287

Which versions are affected by CVE-2012-4446?

2 open source packages ship an affected version, including org.apache.qpid:qpid-client. It affects 1 product.

Products include Apache Qpid.

How do I fix CVE-2012-4446?

Upgrade org.apache.qpid:qpid-client to 0.20 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-4446 being exploited?

There is no known exploitation of CVE-2012-4446 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-0224 Denial of service in n/a High 7.5
• CVE-2011-3620 Auth bypass in n/a High 7.5
• CVE-2019-0223 Security feature bypass in Apache Qpid Proton High 7.4
• CVE-2015-0203 Denial of service in n/a Medium 6.5
• CVE-2013-1909 Apache Qpid Python client Improper certificate validation Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mrgh-6x42-x6xf, UBUNTU-CVE-2012-4446.