medium6.5
CVE-2023-32081
Vert.x STOMP server process client frames that would not send initially a connect frame
Impact
### Impact A Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted. ### Patches The issue is patched in Vert.x 4.4.2 and Vert.x 3.9.16 ### Workarounds No trivial workaround.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.vertx:vertx-stomp | >= 3.1.0, < 3.9.16 | 3.9.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Vert.X Stomp | from 3.1.0 before 3.9.16 from 4.0.0 before 4.4.2 |