Chapter 4. Changes in 3.0.2

4.1. Errata

4.1.1. RHSA-2015:0707 – Moderate: qpid-cpp security and bug fix update

Updated qpid-cpp packages that fix two security issues and one bug are now available for Red Hat Enterprise MRG Messaging 3 for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Security Fixes

CVE-2015-0223
It was discovered that the Qpid daemon (qpidd) did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed.
CVE-2015-0224
A flaw was found in the way the Qpid daemon (qpidd) processed certain protocol sequences. An unauthenticated attacker able to send a specially crafted protocol sequence set could use this flaw to crash qpidd.

Bug Fixes

BZ#1175872
Previously, the neutron messaging client rewrote (by method of "monkey-patching") the python selector module to support eventlet threading. The rewritten client did not update select.poll() during this process, which is used by qpid-python to manage I/O. This resulted in poll() deadlocks and neutron server hangs. The fix introduces updates to the python-qpid library that avoid calling poll() if eventlet threading is detected. Instead, the eventlet-aware select() is called, which prevents deadlocks from occurring and corrects the originally reported issue.
BZ#1186694
It was discovered that the QPID Broker aborted with an uncaught UnknownExchangeTypeException when the client attempted to request an unsupported exchange type. The code for the Exchange Registry and Node Policy has been improved to prevent this issue from happening again.
BZ#1193425
Because of changes in the included security fixes, starting with this release Windows client programs that use the default PLAIN authentication may now fail if authentication is turned off on the broker, where before they erroneously succeeded. To work around this, explicitly use ANONYMOUS by using --connection-options '{sasl_mechanisms:ANONYMOUS}' or you can use a valid username (to work with the default PLAIN mechanism if you have it set up). For example, with valid user 'jsmith', it would be --connection-options '{username:jsmith}'.