CVE-2018-17187: Improper Certificate Validation in proton-j
Summary
CVE-2018-17187: Improper Certificate Validation in proton-j. Affects org.apache.qpid:proton-j versions >= 0.3, < 0.30.0. Fixed in 0.30.0. How to fix ↓
Also tracked for
- qpid-proton · Debian:11
The same CVE-2018-17187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Qpid Proton-J transport is a library that provides support for the AMQP (Advanced Message Queuing Protocol) messaging protocol. It includes an optional wrapper layer to perform TLS (Transport Layer Security) for secure communication. The vulnerability in question affects versions 0.3 to 0.29.0 of the library. By default, the client and server modes do not verify a peer certificate, leaving the client vulnerable to a Man-in-the-Middle (MITM) attack. The option to enable hostname verification was not implemented in these versions, further exacerbating the vulnerability. It is important to note that this vulnerability only affects Proton-J when using the optional transport TLS wrapper layer.
Vulnerability Detail
The vulnerability arises from the lack of proper certificate validation in the Proton-J transport layer. Without explicit configuration, the client and server modes do not verify the peer certificate, making them susceptible to MITM attacks. The absence of hostname verification exacerbates the issue, as it leaves the client open to potential impersonation by an attacker. This vulnerability has a CVSS score of 7.4, indicating a high severity level. It is crucial to upgrade to version 0.30.0 or later and enable the VerifyMode#VERIFY_PEER_NAME configuration to mitigate this vulnerability.
How To Fix
Minimum fixed version
0.30.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to a fixed version of the library is the recommended solution.
Conclusion
The vulnerability in the Apache Qpid Proton-J library allows for improper certificate validation, leaving the client vulnerable to Man-in-the-Middle attacks. To mitigate this vulnerability, it is crucial to upgrade to version 0.30.0 or later and enable the VerifyMode#VERIFY_PEER_NAME configuration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:proton-j →
FAQ
This vulnerability allows an attacker to perform a Man-in-the-Middle attack, potentially intercepting and modifying communication between the client and server.
Versions 0.3 to 0.29.0 of the Apache Qpid Proton-J library are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, this vulnerability has a CVSS score of 7.4, indicating a high severity level.
No, there are no known workarounds for this vulnerability. Upgrading to a fixed version of the library is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:proton-j.
