Apache Qpid Python client Improper certificate validation in qpid-python
Summary
CVE-2013-1909: Apache Qpid Python client Improper certificate validation. Affects qpid-python versions < 0.22. Fixed in 0.22. How to fix ↓
Also tracked for
- qpid-python · Debian:10
The same CVE-2013-1909 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Qpid Python client, known as qpid-python, is a library that provides support for the Qpid messaging protocol in Python applications. It allows developers to interact with Qpid brokers and exchange messages using various messaging patterns. The library is widely used in Python projects that require messaging capabilities.
Vulnerability Detail
The qpid-python client before version 2.2 suffers from an improper certificate validation vulnerability. It fails to verify whether the server hostname matches the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This flaw enables man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary valid certificate. As a result, sensitive information transmitted over SSL/TLS connections can be intercepted or manipulated by attackers.
How To Fix
Latest published version: 1.36.0.post1 as of 23 Oct 2026
pip install --upgrade "qpid-python==1.36.0.post1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.22
This is the first release that contains the fix.
pip install --upgrade "qpid-python==0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of qpid-python to address the issue.
Conclusion
The Apache Qpid Python client (qpid-python) is affected by an improper certificate validation vulnerability. Upgrading to version 0.22 or later is necessary to mitigate this issue. It is recommended that developers update their dependencies and retest their applications to ensure the proper validation of SSL/TLS certificates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpid-python →
FAQ
Qpid-python is a Python client library for the Apache Qpid messaging protocol. It allows Python applications to interact with Qpid brokers and exchange messages.
The vulnerability allows man-in-the-middle attackers to spoof SSL servers, potentially leading to the interception or manipulation of sensitive information transmitted over SSL/TLS connections.
To fix this vulnerability, you should upgrade to qpid-python version 0.22 or later. This version includes the necessary validation checks to ensure the server hostname matches the certificate's domain name.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the official advisory provided by the Apache Qpid project.
Related vulnerabilities
Recent vulnerabilities recorded for qpid-python.
