p PatchFirst

CVE-2019-0223

CVE-2019-0223

This page contains facts from public vulnerability sources. Check the original advisory before updating.

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVSS 7.4 · High · EPSS 6.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache qpid proton

    Versions
    • 0.9 to 0.27.0: Affected

    No fix published

  • qpid-proton Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.22.0-1

    Update to 0.22.0-1

  • qpid-proton Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.22.0-1

    Update to 0.22.0-1

  • qpid-proton Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.22.0-1

    Update to 0.22.0-1

  • qpid-proton Ubuntu:16.04:LTS

    Versions
    • 0.7-2
    • 0.10-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qpid-proton Ubuntu:18.04:LTS

    Versions
    • 0.14.0-5.1
    • 0.14.0-5.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →