CVE-2012-3467
Apache QPID Allows Remote Authentication Bypass
5.0 MediumFix available
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Exploit likelihood
6.39%Up 2.7 points since Feb 4, 2022
What each source reports
NVD Score used
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
- Record
CVE-2012-3467- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
- Record
CVE-2012-3467- Updated
- 2026-11-02
EUVDEUVD-2022-4777 No score
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
- Record
EUVD-2022-4777- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-phw8-fw9g-v3xc No score
Apache QPID Allows Remote Authentication Bypass
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
- Record
GHSA-phw8-fw9g-v3xc- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-phw8-fw9g-v3xc No score
Apache QPID Allows Remote Authentication Bypass
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
- Record
GHSA-phw8-fw9g-v3xc- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.qpid:qpid-parentMaven |
before 0.17 | 0.17 |
mrg-releaseRed Hat:enterprise_mrg:2::el5 |
before 0:2.2.0-1.el5 | 0:2.2.0-1.el5 |
python-qpidRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-11.el5 | 0:0.14-11.el5 |
python-qpid-qmfRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-14.el5 | 0:0.14-14.el5 |
qpid-cpp-clientRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-client-develRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-client-devel-docsRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-client-rdmaRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-client-sslRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-mrgRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
Show 72 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qpid-cpp-mrg-debuginfoRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-serverRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-clusterRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-develRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-rdmaRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-sslRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-storeRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-cpp-server-xmlRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-22.el5 | 0:0.14-22.el5 |
qpid-javaRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-java-clientRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-java-commonRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-java-exampleRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-jcaRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-jca-xarecoveryRed Hat:enterprise_mrg:2::el5 |
before 0:0.18-2.el5 | 0:0.18-2.el5 |
qpid-qmfRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-14.el5 | 0:0.14-14.el5 |
qpid-qmf-debuginfoRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-14.el5 | 0:0.14-14.el5 |
qpid-qmf-develRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-14.el5 | 0:0.14-14.el5 |
qpid-toolsRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-6.el5 | 0:0.14-6.el5 |
ruby-qpid-qmfRed Hat:enterprise_mrg:2::el5 |
before 0:0.14-14.el5 | 0:0.14-14.el5 |
mrg-releaseRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:2.2.0-1.el6 | 0:2.2.0-1.el6 |
python-qpid-qmfRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
qpid-cppRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-clientRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-client-sslRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-debuginfoRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-serverRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-sslRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-qmfRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
qpid-qmf-debuginfoRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
ruby-qpid-qmfRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
xerces-cRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-debuginfoRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-develRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-docRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xqillaRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-debuginfoRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-develRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-docRed Hat:enterprise_mrg:2:computenode:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
mrg-releaseRed Hat:enterprise_mrg:2:server:el6 |
before 0:2.2.0-1.el6 | 0:2.2.0-1.el6 |
python-qpid-qmfRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
qpid-cppRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-clientRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-client-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-client-devel-docsRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-client-rdmaRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-client-sslRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-serverRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-clusterRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-rdmaRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-sslRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-storeRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-cpp-server-xmlRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-22.el6_3 | 0:0.14-22.el6_3 |
qpid-javaRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-java-clientRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-java-commonRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-java-exampleRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-jcaRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-jca-xarecoveryRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.18-2.el6 | 0:0.18-2.el6 |
qpid-qmfRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
qpid-qmf-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
qpid-qmf-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
ruby-qpid-qmfRed Hat:enterprise_mrg:2:server:el6 |
before 0:0.14-14.el6_3 | 0:0.14-14.el6_3 |
xerces-cRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xerces-c-docRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.0.1-20.el6 | 0:3.0.1-20.el6 |
xqillaRed Hat:enterprise_mrg:2:server:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
xqilla-docRed Hat:enterprise_mrg:2:server:el6 |
before 0:2.2.3-8.el6 | 0:2.2.3-8.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3467 is a medium vulnerability (CVSS 5.0) in Apache Qpid, published August 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.39%, the 93rd percentile. Fixed in org.apache.qpid:qpid-parent 0.17.
References
svn.apache.org/viewvc?view=revision&revision=1352992
secunia.com/advisories/50186
securityfocus.com/bid/54954
rhn.redhat.com/errata/RHSA-2012-1279.html
issues.apache.org/jira/browse/QPID-3849
exchange.xforce.ibmcloud.com/vulnerabilities/77568
Show 25 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=836276
openwall.com/lists/oss-security/2012/08/09/6
nvd.nist.gov/vuln/detail/CVE-2012-3467
web.archive.org/web/20200229113556/http://www.securityfocus.com/bid/54954
github.com/advisories/GHSA-phw8-fw9g-v3xc
access.redhat.com/errata/RHSA-2012:1277
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1277.json
cve.org/CVERecord?id=CVE-2012-2145