crítica
CVE-2016-9877
rabbitmq: MQTT connection authentication succeeds with empty password
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (alta), Red Hat (media).
Descripción
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | rabbitmq-server | 3.6.6-1 |
| debian 12 | rabbitmq-server | 3.6.6-1 |
| debian 13 | rabbitmq-server | 3.6.6-1 |
| debian 14 | rabbitmq-server | 3.6.6-1 |
| debian 8 | rabbitmq-server | 3.3.5-1.1+deb8u1 |
| echo | rabbitmq-server | 3.6.6-1 |
| Red Hat | rabbitmq-server | sin corrección indicada |
| ubuntu 14.04 | rabbitmq-server | 3.2.4-1ubuntu0.1 |
| ubuntu 16.04 | rabbitmq-server | 3.5.7-1ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | rabbitmq-server | 3.5.7-1ubuntu0.16.04.2 |
Referencias
- http://www.debian.org/security/2017/dsa-3761
- http://www.securityfocus.com/bid/95065
- https://access.redhat.com/security/cve/CVE-2016-9877
- https://github.com/rabbitmq/rabbitmq-mqtt/pull/98
- https://nvd.nist.gov/vuln/detail/CVE-2016-9877
- https://pivotal.io/security/cve-2016-9877
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us
- https://ubuntu.com/security/notices/USN-3374-1