CVE-2018-1298 Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
Unauthenticated attackers can crash the Apache Qpid Broker-J instance via AMQP connections if specific SASL authentication providers are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1298?
CVE-2018-1298 is a medium-severity denial of service vulnerability in Apache Qpid Broker-J, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.
Weakness: CWE-20
Which versions are affected by CVE-2018-1298?
2 open source packages ship an affected version, including org.apache.qpid:apache-qpid-broker-j. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.qpid:apache-qpid-broker-j Maven | From 7.0.0 | 7.0.1 |
org.apache.qpid:apache-qpid-broker-j Maven | From 7.0.0 | 7.0.1 |
Products include Apache Qpid Broker-J.
How do I fix CVE-2018-1298?
Upgrade org.apache.qpid:apache-qpid-broker-j to 7.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1298 being exploited?
There is no known exploitation of CVE-2018-1298 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Broker-J
- CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing
- CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
- CVE-2026-92550 Denial of service in Apache Qpid Broker-J
- CVE-2026-92560 Denial of service in Apache Qpid Broker-J
Sources
Also known as GHSA-6w3v-66mj-2qm6.