{"id":"CVE-2016-9877","details":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","modified":"2026-07-08T05:51:18.248504071Z","published":"2016-12-29T09:59:00.790Z","related":["openSUSE-SU-2024:11294-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"pivotal_software:rabbitmq","cpes":["cpe:2.3:a:pivotal_software:rabbitmq:1.5.10:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.11:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.12:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.13:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.14:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.15:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.17:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.18:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.6:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.7:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.8:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.9:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.10:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.1:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.2:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.6:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.7:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.8:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.9:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.6:*:*:*:*:pivotal_cloud_foundry:*:*"],"extracted_events":[{"introduced":"1.5.6"},{"last_affected":"1.5.6"},{"introduced":"1.5.7"},{"last_affected":"1.5.7"},{"introduced":"1.5.8"},{"last_affected":"1.5.8"},{"introduced":"1.5.9"},{"last_affected":"1.5.9"},{"introduced":"1.5.10"},{"last_affected":"1.5.10"},{"introduced":"1.5.11"},{"last_affected":"1.5.11"},{"introduced":"1.5.12"},{"last_affected":"1.5.12"},{"introduced":"1.5.13"},{"last_affected":"1.5.13"},{"introduced":"1.5.14"},{"last_affected":"1.5.14"},{"introduced":"1.5.15"},{"last_affected":"1.5.15"},{"introduced":"1.5.17"},{"last_affected":"1.5.17"},{"introduced":"1.5.18"},{"last_affected":"1.5.18"},{"introduced":"1.6.1"},{"last_affected":"1.6.1"},{"introduced":"1.6.2"},{"last_affected":"1.6.2"},{"introduced":"1.6.3"},{"last_affected":"1.6.3"},{"introduced":"1.6.4"},{"last_affected":"1.6.4"},{"introduced":"1.6.5"},{"last_affected":"1.6.5"},{"introduced":"1.6.6"},{"last_affected":"1.6.6"},{"introduced":"1.6.7"},{"last_affected":"1.6.7"},{"introduced":"1.6.8"},{"last_affected":"1.6.8"},{"introduced":"1.6.9"},{"last_affected":"1.6.9"},{"introduced":"1.6.10"},{"last_affected":"1.6.10"},{"introduced":"1.7.3"},{"last_affected":"1.7.3"},{"introduced":"1.7.4"},{"last_affected":"1.7.4"},{"introduced":"1.7.5"},{"last_affected":"1.7.5"},{"introduced":"1.7.6"},{"last_affected":"1.7.6"}],"source":"CPE_STRING"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/95065"},{"type":"WEB","url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us"},{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3761"},{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2016-9877"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-server","events":[{"introduced":"100b64db3d02bdce28dd13db3c090d3ff5243c60"},{"last_affected":"758c952bf09cb933955a97c90271bfa80ea7c366"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:broadcom:rabbitmq_server:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.0.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.0.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.0.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.0.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.1.5:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.2.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.2.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.2.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.3.5:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.0:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.1:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.2:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.3:*:*:*:*:*:*:*","cpe:2.3:a:broadcom:rabbitmq_server:3.5.6:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.5.7:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.0:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.1:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.2:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.3:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.4:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:3.6.5:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.1:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.2:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.3:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.4:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.5.5:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.6.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.0:*:*:*:*:pivotal_cloud_foundry:*:*","cpe:2.3:a:pivotal_software:rabbitmq:1.7.2:*:*:*:*:pivotal_cloud_foundry:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"},{"introduced":"3.0.1"},{"last_affected":"3.0.1"},{"introduced":"3.0.2"},{"last_affected":"3.0.2"},{"introduced":"3.0.3"},{"last_affected":"3.0.3"},{"introduced":"3.0.4"},{"last_affected":"3.0.4"},{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"introduced":"3.1.1"},{"last_affected":"3.1.1"},{"introduced":"3.1.2"},{"last_affected":"3.1.2"},{"introduced":"3.1.3"},{"last_affected":"3.1.3"},{"introduced":"3.1.4"},{"last_affected":"3.1.4"},{"introduced":"3.1.5"},{"last_affected":"3.1.5"},{"introduced":"3.2.0"},{"last_affected":"3.2.0"},{"introduced":"3.2.1"},{"last_affected":"3.2.1"},{"introduced":"3.2.2"},{"last_affected":"3.2.2"},{"introduced":"3.2.3"},{"last_affected":"3.2.3"},{"introduced":"3.2.4"},{"last_affected":"3.2.4"},{"introduced":"3.3.0"},{"last_affected":"3.3.0"},{"introduced":"3.3.1"},{"last_affected":"3.3.1"},{"introduced":"3.3.2"},{"last_affected":"3.3.2"},{"introduced":"3.3.3"},{"last_affected":"3.3.3"},{"introduced":"3.3.4"},{"last_affected":"3.3.4"},{"introduced":"3.3.5"},{"last_affected":"3.3.5"},{"introduced":"3.4.0"},{"last_affected":"3.4.0"},{"introduced":"3.4.1"},{"last_affected":"3.4.1"},{"introduced":"3.4.2"},{"last_affected":"3.4.2"},{"introduced":"3.4.3"},{"last_affected":"3.4.3"},{"introduced":"3.4.4"},{"last_affected":"3.4.4"},{"introduced":"3.5.0"},{"last_affected":"3.5.0"},{"introduced":"3.5.1"},{"last_affected":"3.5.1"},{"introduced":"3.5.2"},{"last_affected":"3.5.2"},{"introduced":"3.5.3"},{"last_affected":"3.5.3"},{"introduced":"3.5.6"},{"last_affected":"3.5.6"},{"introduced":"3.5.4"},{"last_affected":"3.5.4"},{"introduced":"3.5.5"},{"last_affected":"3.5.5"},{"introduced":"3.5.7"},{"last_affected":"3.5.7"},{"introduced":"3.6.0"},{"last_affected":"3.6.0"},{"introduced":"3.6.1"},{"last_affected":"3.6.1"},{"introduced":"3.6.2"},{"last_affected":"3.6.2"},{"introduced":"3.6.3"},{"last_affected":"3.6.3"},{"introduced":"3.6.4"},{"last_affected":"3.6.4"},{"introduced":"3.6.5"},{"last_affected":"3.6.5"},{"introduced":"1.5.0"},{"last_affected":"1.5.0"},{"introduced":"1.5.1"},{"last_affected":"1.5.1"},{"introduced":"1.5.2"},{"last_affected":"1.5.2"},{"introduced":"1.5.3"},{"last_affected":"1.5.3"},{"introduced":"1.5.4"},{"last_affected":"1.5.4"},{"introduced":"1.5.5"},{"last_affected":"1.5.5"},{"introduced":"1.6.0"},{"last_affected":"1.6.0"},{"introduced":"1.7.0"},{"last_affected":"1.7.0"},{"introduced":"1.7.2"},{"last_affected":"1.7.2"}]}}],"versions":["1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.7.0","1.7.2","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9877.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}