Description

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.

Remediation

References

https://issues.apache.org/jira/browse/QPID-7599

http://qpid.2158936.n2.nabble.com/CVE-2016-8741-Apache-Qpid-Broker-for-Java-Information-Leakage-td7657025.html

http://www.securityfocus.com/bid/95136

http://www.securitytracker.com/id/1037537

Related Vulnerabilities

CVE-2014-3603 Vulnerability in maven package org.opensaml:opensaml

CVE-2022-24725 Vulnerability in npm package shescape

CVE-2021-39171 Vulnerability in npm package passport-saml

CVE-2018-11696 Vulnerability in maven package org.webjars.npm:node-sass

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Issue Tracking Vendor Advisory Broken Link Third Party Advisory VDB Entry