#VU21142 Improper Certificate Validation in Apache Qpid Proton - CVE-2019-0223
Published: September 17, 2019
Vulnerability identifier: #VU21142
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-0223
CWE-ID: CWE-295
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerable software:
Apache Qpid Proton
Apache Qpid Proton
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to perform man-in-the-middle attack.
The vulnerability exists due to Apache Qpid Proton (C library and its language bindings) allows anonymous TLS connections to with the peer, even when configured to verify the peer certificate. A remote attacker with ability to intercept and decrypt TLS traffic and perform MitM attack.
Remediation
Install updates from vendor's website.
External links
- http://www.openwall.com/lists/oss-security/2019/04/23/4
- http://www.securityfocus.com/bid/108044
- https://access.redhat.com/errata/RHSA-2019:0886
- https://access.redhat.com/errata/RHSA-2019:1398
- https://access.redhat.com/errata/RHSA-2019:1399
- https://access.redhat.com/errata/RHSA-2019:1400
- https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel
- https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f@%3Cusers.qpid.apache.org%3E
- https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5@%3Cdev.qpid.apache.org%3E
- https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b@%3Cdev.qpid.apache.org%3E
- https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E
- https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0@%3Cannounce.apache.org%3E