CVE-2013-1909: qpid-python - SSL Server Spoofing Vulnerability
Summary
CVE-2013-1909: The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middl... Affects qpid-python versions < 0.22. Fixed in 0.22. How to fix ↓
Also tracked for
- qpid-python · Debian:10
The same CVE-2013-1909 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qpid-python is a Python client for Apache Qpid, a messaging system that implements the Advanced Message Queuing Protocol (AMQP). It allows Python applications to communicate with AMQP brokers. The qpid-python package is available on PyPI (Python Package Index) and is widely used in various applications.
Vulnerability Detail
The Python client in Apache Qpid before version 2.2 does not properly verify the server hostname against the domain name in the X.509 certificate. This vulnerability enables man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary valid certificate. By exploiting this vulnerability, an attacker can intercept and manipulate the communication between the client and the server, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
0.22
This is the first release that contains the fix.
pip install --upgrade "qpid-python==0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Apache Qpid.
Conclusion
The SSL server spoofing vulnerability in qpid-python can be mitigated by upgrading to Apache Qpid version 2.2 or later. It is crucial to promptly apply the recommended fix to ensure the integrity and security of the communication between the client and the server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qpid-python →
FAQ
qpid-python is a Python client for Apache Qpid, an AMQP messaging system.
This vulnerability allows man-in-the-middle attackers to spoof SSL servers, potentially leading to unauthorized access or data manipulation.
To fix this vulnerability, upgrade to Apache Qpid version 2.2 or later.
No, there is no known workaround for this vulnerability.
For more information, you can visit the source link: https://github.com/pypa/advisory-database/blob/main/vulns/qpid-python/PYSEC-2013-25.yaml
Related vulnerabilities
Recent vulnerabilities recorded for qpid-python.
