[PKG-Openstack-devel] Bug#849849: rabbitmq-server: CVE-2016-9877
carnil at debian.org
Sun Jan 1 11:13:30 UTC 2017
Tags: upstream security
Justification: user security hole
the following vulnerability was published for rabbitmq-server.
| An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x
| before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before
| 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport)
| connection authentication with a username/password pair succeeds if an
| existing username is provided but the password is omitted from the
| connection request. Connections that use TLS with a client-provided
| certificate are not affected.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
Please adjust the affected versions in the BTS as needed. I was only
able to check the vulnerability sourcewise for 3.6.5 in unstable,
older version have not been checked so far.
More information about the Openstack-devel