High severity · published Apr 23, 2019
CVE-2019-0223
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a…
7.4
CVSS
6.2%
EPSS
No
On KEV
Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
6.7; 7.2; 7.3; 7.4; 7.5; 7.6 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
5.9; 6.4; 6.5; 6.6; 7.2; 7.3; +2 more · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.2; 7.3; 7.4; 7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
JA
Jboss Amq Clients 2 · Redhat
All versions, or not specified · source: NVD
OP
Openstack · Redhat
13; 14 · source: NVD
QP
Qpid · Apache
0.9 through 0.27.0 · source: NVD
SA
Satellite · Redhat
6.3; 6.4; 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0223
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0223
Mailing List
http://www.openwall.com/lists/oss-security/2019/04/23/4
Broken Link
http://www.securityfocus.com/bid/108044
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0886
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1398
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1399
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1400
More from Qpid
7.5
CVE-2015-0224
qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set
6.5
CVE-2015-0203
The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a…
–
CVE-2015-0223
Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling
–
CVE-2014-3629
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message
–
CVE-2013-1909
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…