CVE-2016-9877
CVE-2016-9877
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
CVSS 9.8 · Critical · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
pivotal rabbitmq 3.x before 3.5.8 and 3.6.x before 3.6.6; rabbitmq for pcf 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- Versions
- Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7: Affected
No fix published
rabbitmq-server Debian:12
- Affected ranges
- ECOSYSTEM: < 3.6.6-1
Update to 3.6.6-1
rabbitmq-server Debian:13
- Affected ranges
- ECOSYSTEM: < 3.6.6-1
Update to 3.6.6-1
rabbitmq-server Debian:14
- Affected ranges
- ECOSYSTEM: < 3.6.6-1
Update to 3.6.6-1
rabbitmq-server Ubuntu:14.04:LTS
- Versions
- 3.1.3-1
- 3.1.5-1
- 3.2.0-1
- 3.2.1-1
- 3.2.2-1
- 3.2.3-1
- 3.2.4-1
- Affected ranges
- ECOSYSTEM: < 3.2.4-1ubuntu0.1
Update to 3.2.4-1ubuntu0.1
rabbitmq-server Ubuntu:16.04:LTS
- Versions
- 3.5.4-1
- 3.5.4-3
- 3.5.4-3.1
- 3.5.7-1
- 3.5.7-1ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 3.5.7-1ubuntu0.16.04.2
Update to 3.5.7-1ubuntu0.16.04.2