CVE-2019-0223: Improper Certificate Validation in Apache Qpid Proton
Summary
CVE-2019-0223: Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton. Affects org.apache.qpid:proton-j versions >= 0.9, < 0.27.1. Fixed in 0.27.1. How to fix ↓
Also tracked for
- qpid-proton · Debian:11
The same CVE-2019-0223 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Proton is a messaging library that implements the Advanced Message Queuing Protocol (AMQP). It provides a set of APIs and language bindings for various programming languages. The library allows applications to communicate with each other using a secure and reliable messaging system. However, versions 0.9 to 0.27.0 of Apache Qpid Proton, when used with OpenSSL versions before 1.1.0, are vulnerable to an improper certificate validation issue.
Vulnerability Detail
The vulnerability arises from a bug (PROTON-2014) in Apache Qpid Proton. In certain scenarios, the library can establish an anonymous TLS connection to a peer, even when configured to verify the peer certificate. This means that an attacker could potentially perform a man-in-the-middle attack by intercepting the TLS traffic without being detected. The vulnerability has a CVSS score of 7.4, indicating a high severity.
How To Fix
Minimum fixed version
0.27.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of Apache Qpid Proton.
Conclusion
The improper certificate validation vulnerability in Apache Qpid Proton can potentially enable man-in-the-middle attacks. It is crucial to upgrade to the patched version of the library (0.27.1 or later) to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.qpid:proton-j →
FAQ
Apache Qpid Proton is a messaging library that implements the Advanced Message Queuing Protocol (AMQP). It provides APIs and language bindings for various programming languages.
The vulnerability allows an attacker to perform a man-in-the-middle attack by intercepting TLS traffic. This can lead to unauthorized access, data leakage, and potential compromise of the communication channel.
Versions 0.9 to 0.27.0 of Apache Qpid Proton are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the patched version of Apache Qpid Proton.
The CVSS score of this vulnerability is 7.4, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.qpid:proton-j.
