critique
CVE-2016-9877
rabbitmq: MQTT connection authentication succeeds with empty password
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (élevée), Red Hat (moyenne).
Description
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | rabbitmq-server | 3.6.6-1 |
| debian 12 | rabbitmq-server | 3.6.6-1 |
| debian 13 | rabbitmq-server | 3.6.6-1 |
| debian 14 | rabbitmq-server | 3.6.6-1 |
| debian 8 | rabbitmq-server | 3.3.5-1.1+deb8u1 |
| echo | rabbitmq-server | 3.6.6-1 |
| Red Hat | rabbitmq-server | pas de correctif indiqué |
| ubuntu 14.04 | rabbitmq-server | 3.2.4-1ubuntu0.1 |
| ubuntu 16.04 | rabbitmq-server | 3.5.7-1ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | rabbitmq-server | 3.5.7-1ubuntu0.16.04.2 |
Références
- http://www.debian.org/security/2017/dsa-3761
- http://www.securityfocus.com/bid/95065
- https://access.redhat.com/security/cve/CVE-2016-9877
- https://github.com/rabbitmq/rabbitmq-mqtt/pull/98
- https://nvd.nist.gov/vuln/detail/CVE-2016-9877
- https://pivotal.io/security/cve-2016-9877
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us
- https://ubuntu.com/security/notices/USN-3374-1