Apache Qpid Proton-J Transport TLS Wrapper Vulnerability (CVE-2018-17187)
Summary
CVE-2018-17187: The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Affects qpid-proton across 2 version ranges.
< 0.22.0-1
>= 5b8f241139962b1c4ef17a37f58ac6636845d1b7, <= 755e8f67b39c33e36687b8005e868f0d19346140
Fixed in 0.22.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Qpid Proton-J is a Java library that provides messaging functionality for applications. It includes a transport layer that supports TLS encryption for secure communication. However, versions 0.3 to 0.29.0 of Proton-J did not implement hostname verification when using TLS, leaving clients vulnerable to Man-in-the-Middle (MITM) attacks. This means that an attacker could intercept and modify the communication between the client and server without detection.
Vulnerability Detail
The vulnerability (CVE-2018-17187) in Apache Qpid Proton-J versions 0.3 to 0.29.0 allows for potential MITM attacks due to the lack of hostname verification in the TLS wrapper layer. By default, the client and server modes do not verify the peer certificate, making it possible for an attacker to impersonate the server and intercept or modify the communication. This can lead to unauthorized access, data leakage, or tampering of sensitive information.
How To Fix
Minimum fixed version
0.22.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qpid-protonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version and enabling hostname verification is the recommended solution.
Conclusion
The Apache Qpid Proton-J Transport TLS Wrapper Vulnerability (CVE-2018-17187) exposes clients to potential Man-in-the-Middle (MITM) attacks due to the lack of hostname verification. To mitigate this vulnerability, it is crucial to upgrade to version 0.30.0 or later and enable hostname verification using the VerifyMode#VERIFY_PEER_NAME configuration. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for qpid-proton →
FAQ
Apache Qpid Proton-J is a Java library that provides messaging functionality for applications. It enables secure communication using various protocols, including AMQP.
The vulnerability allows for potential Man-in-the-Middle (MITM) attacks, where an attacker can intercept and modify communication between the client and server. This can lead to unauthorized access, data leakage, or tampering of sensitive information.
Versions 0.3 to 0.29.0 of Apache Qpid Proton-J are affected by this vulnerability.
To fix this vulnerability, upgrade to Apache Qpid Proton-J version 0.30.0 or later. Additionally, enable hostname verification using the VerifyMode#VERIFY_PEER_NAME configuration.
There is no known workaround for this vulnerability. Upgrading to the fixed version and enabling hostname verification is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for qpid-proton.
