Not rated
CVE-2019-0223 While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to…
Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Qpid Proton | Versions not published |
References
- [qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability lists.apache.org
- [qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability lists.apache.org
- [oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability www.openwall.com
- [announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability lists.apache.org
- [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability lists.apache.org
- issues.apache.org issues.apache.org
- qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223 lists.apache.org
- 108044 www.securityfocus.com
- RHSA-2019:0886 access.redhat.com
- RHSA-2019:1399 access.redhat.com
- RHSA-2019:1400 access.redhat.com
- RHSA-2019:1398 access.redhat.com
- RHSA-2019:2777 access.redhat.com
- RHSA-2019:2778 access.redhat.com
- RHSA-2019:2779 access.redhat.com
- RHSA-2019:2780 access.redhat.com
- RHSA-2019:2781 access.redhat.com
- RHSA-2019:2782 access.redhat.com
Timeline
- Published
- Last modified