CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17187
https://notcve.org/view.php?id=CVE-2018-17187
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. • http://www.securityfocus.com/bid/105935 https://issues.apache.org/jira/browse/PROTON-1962 https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E https://qpid.apache.org/cves/CVE-2018-17187.html • CWE-295: Improper Certificate Validation •
CVSS: 5.9EPSS: 0%CPEs: 10EXPL: 0CVE-2016-4467
https://notcve.org/view.php?id=CVE-2016-4467
The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. El cliente en C y basado en C, en la librería Apache Qpid Proton anterior a la versión 0.13.1 en Windows no verifica correctamente que el nombre de host del servidor coincide con un nombre de dominio en el Common Name (CN) del asunto o en el campo subjectAltName del certificado X.509 cuando se utiliza una capa de seguridad basada en SChannel, lo que permite a atacantes miTm suplantar servidores a través de un certificado válido. • http://www.openwall.com/lists/oss-security/2016/07/15/3 http://www.securityfocus.com/bid/91788 http://www.securitytracker.com/id/1036316 https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-2166
https://notcve.org/view.php?id=CVE-2016-2166
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors. Las clases (1) proton.reactor.Connector, (2) proton.reactor.Container y (3) proton.utils.BlockingConnection en Apache Qpid Proton en versiones anteriores a 0.12.1 usan de forma incorrecta una conexión cifrada para un esquema URI amqps cuando el soporte SSL no está disponible, lo que podría permitir a atacantes man-in-the-middle obtener información sensible o modificar datos a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.html http://packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.html http://qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.html http://www.securityfocus.com/archive/1/537864/100/0/threaded https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git%3Bh=a058585 https://issues.apache.org/jira/browse/PROTON-1157 https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcde • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •