PublicDateAtUSN: 2016-12-29
Candidate: CVE-2016-9877
PublicDate: 2016-12-29 09:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9877
 https://pivotal.io/security/cve-2016-9877
 https://github.com/rabbitmq/rabbitmq-mqtt/pull/98
 https://ubuntu.com/security/notices/USN-3374-1
Description:
 An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x
 before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12,
 and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection
 authentication with a username/password pair succeeds if an existing
 username is provided but the password is omitted from the connection
 request. Connections that use TLS with a client-provided certificate are
 not affected.
Ubuntu-Description:
Notes:
Bugs:
 https://github.com/rabbitmq/rabbitmq-mqtt/issues/96
 https://launchpad.net/bugs/1706900
Priority: high
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_rabbitmq-server:
 upstream: https://github.com/rabbitmq/rabbitmq-mqtt/commit/039a3c22e57bf77b325d19494a9b20cd745f1ea7 (3.7.0)
 upstream: https://github.com/rabbitmq/rabbitmq-mqtt/commit/157948d86d391a325ac9702f78976c175ced58be (3.5.8)
upstream_rabbitmq-server: released (3.5.8, 3.6.6)
precise_rabbitmq-server: ignored (reached end-of-life)
precise/esm_rabbitmq-server: DNE (precise was needed)
trusty_rabbitmq-server: released (3.2.4-1ubuntu0.1)
trusty/esm_rabbitmq-server: DNE (trusty was released [3.2.4-1ubuntu0.1])
vivid/stable-phone-overlay_rabbitmq-server: DNE
vivid/ubuntu-core_rabbitmq-server: DNE
xenial_rabbitmq-server: released (3.5.7-1ubuntu0.16.04.2)
esm-infra/xenial_rabbitmq-server: released (3.5.7-1ubuntu0.16.04.2)
yakkety_rabbitmq-server: ignored (reached end-of-life)
zesty_rabbitmq-server: not-affected (3.6.6-1)
devel_rabbitmq-server: not-affected (3.6.6-1)