CVE-2016-8741

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication

published May 15, 2017

CVSS
—
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06299 · 93.6th percentile
Published
2017-05-15T14:00Z
EPSS history
Timeline
  • 15 MAY 14:00Z
    The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication
    cvelistv5