CVE-2016-3094: Improper Input Validation in org.apache.qpid:qpid-broker
5.9
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.70957%
CWE
Published
10/16/2018
Updated
11/12/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.qpid:qpid-broker | maven | < 6.0.3 | 6.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability manifests in the SASL authentication flow when handling client responses. The core issue is in PlainSaslServer's response evaluation method:
- The JIRA ticket QPID-7271 explicitly mentions fixing exception handling in PlainSaslServer
- SASL mechanisms in Java typically implement evaluateResponse() for authentication processing
- The vulnerability description specifies uncaught exceptions during authentication attempts
- The plaintext authentication mechanism would split client input into username/password components using null byte separators - a process vulnerable to malformed inputs
- Pre-patch versions lack proper try-catch blocks around this parsing logic, letting runtime exceptions propagate to the JVM
- The patched version (6.0.3) adds explicit SaslException handling as seen in the JIRA resolution comment