CVE-2019-0223

CWE-358CWE-300CWE-295 — Improper Certificate ValidationCWE-284 — Improper Access Control11 documents7 sources
Severity
7.4HIGH
EPSS
0.4%
top 39.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Apache QpidApache Software Foundation Apache Qpid ProtonRedhat Enterprise Linux Desktop+7 more
Timeline
PublishedApr 23
Latest updateMay 24

Description

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages9 packages

▶Mavenorg.apache.qpid:proton-j0.9 — 0.27.1
▶Debianqpid-proton< 0.22.0-1+3
▶NVDapache/qpid0.9 — 0.27.0
▶NVDredhat/openstack13, 14+1

Also affects: Enterprise Linux 6.7, 7.2, 7.3, 7.4, 7.5, 7.6, 5.9, 6.4, 6.5, 6.6

🔴Vulnerability Details

4
GHSA
Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton↗2022-05-24
▶
GHSA
slixmpp Incorrect Access Control↗2022-05-13
▶
CVEList
CVE-2019-0223: While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0↗2019-04-23
▶
OSV
CVE-2019-0223: While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0↗2019-04-23
▶

📋Vendor Advisories

2
Red Hat
qpid-proton: TLS Man in the Middle Vulnerability↗2019-04-23
▶
Debian
CVE-2019-0223: qpid-proton - While investigating bug PROTON-2014, we discovered that under some circumstances...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability↗2019-04-23
▶
Bugzilla
CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability [openstack-rdo]↗2019-04-23
▶
Bugzilla
CVE-2019-1000021 python-slixmpp: Improper acccess control in XEP-0223 plugin↗2019-02-06
▶
CVE-2019-0223 (HIGH CVSS 7.4) | While investigating bug PROTON-2014 | cvebase.io