vulnwire
7.5high

CVE-2018-8030

Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents

Also known as GHSA-7xr3-rgwh-pw22

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
0
none known

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.

Exploit prediction (EPSS)

3.79% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.qpid:apache-qpid-broker-j
>=7.0.0, <7.1.0
7.1.0

Affected products

  • Apache Software Foundation Apache Qpid Broker-J

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • securitytracker.com /id/1041138 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apache.org /thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876%40%3Cusers.qpid.apac · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-8030 · advisory
  • github.com /apache/qpid-broker-j/commit/025b48f3193e2b10b1c41d2bc3bcfc9cfc238a27 · web
  • github.com /advisories/GHSA-7xr3-rgwh-pw22 · advisory
  • github.com /apache/qpid-broker-j · web
  • issues.apache.org /jira/browse/QPID-8203 · web
  • lists.apache.org /thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876@%3Cusers.qpid.apache · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.