Authentication Bypass in Pivotal RabbitMQ Across Multiple Versions
CVE-2016-9877
Key Information:
- Vendor
Pivotal Software
- Vendor
- CVE Published:
- 29 December 2016
What is CVE-2016-9877?
An authentication bypass vulnerability exists in Pivotal RabbitMQ, allowing an attacker to successfully authenticate without providing a password if a valid username is supplied in an MQTT connection request. This issue affects several versions of RabbitMQ, specifically those prior to the noted releases in the 3.x and 1.x series. Notably, connections secured with TLS and involving client-provided certificates remain unaffected, mitigating some risk in secured environments.
Affected Version(s)
Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7