[Bug 1706900] [NEW] CVE-2016-9877 RabbitMQ authentication vulnerability

[Nils Toedtmann]

*** This bug is a security vulnerability ***

Public security bug reported:

https://pivotal.io/security/cve-2016-9877

  "MQTT (MQ Telemetry Transport) connection authentication with a
username/password pair succeeds if an existing username is provided but
the password is omitted from the connection request. Connections that
use TLS with a client-provided certificate are not affected."

Affects RabbitMQ "3.x versions prior to 3.5.8"

Ubuntu's Xenial repos are currently offering 3.5.7-1ubuntu0.16.04.1, and
according to its changelog, Pivotal's fix for CVE-2016-9877 has not been
included.

** Affects: rabbitmq
     Importance: Unknown
         Status: Unknown

** Affects: rabbitmq-server (Ubuntu)
     Importance: Undecided
         Status: New

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to rabbitmq-server in Ubuntu.
https://bugs.launchpad.net/bugs/1706900

Title:
  CVE-2016-9877 RabbitMQ authentication vulnerability

Status in RabbitMQ:
  Unknown
Status in rabbitmq-server package in Ubuntu:
  New

Bug description:
  https://pivotal.io/security/cve-2016-9877

    "MQTT (MQ Telemetry Transport) connection authentication with a
  username/password pair succeeds if an existing username is provided
  but the password is omitted from the connection request. Connections
  that use TLS with a client-provided certificate are not affected."

  Affects RabbitMQ "3.x versions prior to 3.5.8"

  Ubuntu's Xenial repos are currently offering 3.5.7-1ubuntu0.16.04.1,
  and according to its changelog, Pivotal's fix for CVE-2016-9877 has
  not been included.

To manage notifications about this bug go to:
https://bugs.launchpad.net/rabbitmq/+bug/1706900/+subscriptions