CVE-2018-8030: Apache Qpid Broker-J Denial of Service Vulnerability when AMQP 0-8...0-91 messages exceed maximum size limit
Severity
Important
Affected components
Qpid Broker-J
Affected versions
7.0.0, 7.0.1, 7.0.2, 7.0.3 and 7.0.4
Fixed versions
7.0.5
Description
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Resolution
Users of Broker-J versions 7.0.0-7.0.4 utilizing AMQP protocols 0-8, 0-9 or 0-91 for message publishing must upgrade to version 7.0.5 or later.
Mitigation
If upgrade of the broker is not possible, the maximum message size limit can be disabled by setting context variable "qpid.max_message_size" to "0" or any negative value. The change can be made either directly in the broker configuration file, or by using management interfaces (for example, REST API) or by sing JVM option -Dqpid.max_message_size=0. A broker restart is required for the change to take effect. Alternatively, the support for AMQP protocols 0-8...0-91 can be removed on AMQP ports. The change can be made either directly in the broker configuration file or by using management interfaces. An example of REST API call restricting AMQP port to support only to AMQP 1.0 and AMQP 0-10 using curl utility is provided below:
sh
curl --user <user-name> -X POST -d '{"protocols":["AMQP_1_0","AMQP_0_10"]}' https://<broker host>:<broker port>/api/latest/port/<port name>
References
Apache Qpid, Messaging built on AMQP; Copyright © 2015 The Apache Software Foundation; Licensed under the Apache License, Version 2.0; Apache Qpid, Qpid, Qpid Proton, Proton, Apache, the Apache feather logo, and the Apache Qpid project logo are trademarks of The Apache Software Foundation; All other marks mentioned may be trademarks or registered trademarks of their respective owners