VIR Vulnerability Intelligence Relay

CVE-2016-9877

critical
Published 2016-12-29 · Modified 2026-05-06
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-9877

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-9877.html

vendor Authored 2026-05-27

Vendor advisory: security_alert@emc.com — https://pivotal.io/security/cve-2016-9877

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbookwormfixed3.6.6-1
debian debianbullseyefixed3.6.6-1
debian debianforkyfixed3.6.6-1
debian debiansidfixed3.6.6-1
debian debiantrixiefixed3.6.6-1

Application impact
VendorProductVersionsFixed
broadcomrabbitmq_server3.0.0
broadcomrabbitmq_server3.0.1
broadcomrabbitmq_server3.0.2
broadcomrabbitmq_server3.0.3
broadcomrabbitmq_server3.0.4
broadcomrabbitmq_server3.1.0
broadcomrabbitmq_server3.1.1
broadcomrabbitmq_server3.1.2
broadcomrabbitmq_server3.1.3
broadcomrabbitmq_server3.1.4
broadcomrabbitmq_server3.1.5
broadcomrabbitmq_server3.2.0
broadcomrabbitmq_server3.2.1
broadcomrabbitmq_server3.2.2
broadcomrabbitmq_server3.2.3
broadcomrabbitmq_server3.2.4
broadcomrabbitmq_server3.3.0
broadcomrabbitmq_server3.3.1
broadcomrabbitmq_server3.3.2
broadcomrabbitmq_server3.3.3
broadcomrabbitmq_server3.3.4
broadcomrabbitmq_server3.3.5
broadcomrabbitmq_server3.4.0
broadcomrabbitmq_server3.4.1
broadcomrabbitmq_server3.4.2
broadcomrabbitmq_server3.4.3
broadcomrabbitmq_server3.4.4
broadcomrabbitmq_server3.5.0
broadcomrabbitmq_server3.5.1
broadcomrabbitmq_server3.5.2
broadcomrabbitmq_server3.5.3
broadcomrabbitmq_server3.5.6
pivotal_softwarerabbitmq3.5.4
pivotal_softwarerabbitmq3.5.5
pivotal_softwarerabbitmq3.5.7
pivotal_softwarerabbitmq3.6.0
pivotal_softwarerabbitmq3.6.1
pivotal_softwarerabbitmq3.6.2
pivotal_softwarerabbitmq3.6.3
pivotal_softwarerabbitmq3.6.4
pivotal_softwarerabbitmq3.6.5
pivotal_softwarerabbitmq1.5.0
pivotal_softwarerabbitmq1.5.1
pivotal_softwarerabbitmq1.5.2
pivotal_softwarerabbitmq1.5.3
pivotal_softwarerabbitmq1.5.4
pivotal_softwarerabbitmq1.5.5
pivotal_softwarerabbitmq1.5.6
pivotal_softwarerabbitmq1.5.7
pivotal_softwarerabbitmq1.5.8
pivotal_softwarerabbitmq1.5.9
pivotal_softwarerabbitmq1.5.10
pivotal_softwarerabbitmq1.5.11
pivotal_softwarerabbitmq1.5.12
pivotal_softwarerabbitmq1.5.13
pivotal_softwarerabbitmq1.5.14
pivotal_softwarerabbitmq1.5.15
pivotal_softwarerabbitmq1.5.17
pivotal_softwarerabbitmq1.5.18
pivotal_softwarerabbitmq1.6.0
pivotal_softwarerabbitmq1.6.1
pivotal_softwarerabbitmq1.6.2
pivotal_softwarerabbitmq1.6.3
pivotal_softwarerabbitmq1.6.4
pivotal_softwarerabbitmq1.6.5
pivotal_softwarerabbitmq1.6.6
pivotal_softwarerabbitmq1.6.7
pivotal_softwarerabbitmq1.6.8
pivotal_softwarerabbitmq1.6.9
pivotal_softwarerabbitmq1.6.10
pivotal_softwarerabbitmq1.7.0
pivotal_softwarerabbitmq1.7.2
pivotal_softwarerabbitmq1.7.3
pivotal_softwarerabbitmq1.7.4
pivotal_softwarerabbitmq1.7.5
pivotal_softwarerabbitmq1.7.6

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.