Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Apache Qpid Proton by Apache Software Foundation

    CVE-2019-0223 (GCVE-0-2019-0223)

    Vulnerability from nvd – Published: 2019-04-23 15:57 – Updated: 2024-08-04 17:44
    VLAI
    Summary
    While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
    Severity
    No CVSS data available.
    CWE
    • Man-in-the-middle Attack
    Assigner
    References
    URL Tags
    https://lists.apache.org/thread.html/49c83f0acce5… mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/3adb2f020f70… mailing-listx_refsource_MLIST
    http://www.openwall.com/lists/oss-security/2019/04/23/4 mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/d9c9a882a292… mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/008ee5e78e5a… mailing-listx_refsource_MLIST
    https://issues.apache.org/jira/browse/PROTON-2014… x_refsource_MISC
    https://lists.apache.org/thread.html/914424e4d798… mailing-listx_refsource_MLIST
    http://www.securityfocus.com/bid/108044 vdb-entryx_refsource_BID
    https://access.redhat.com/errata/RHSA-2019:0886 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1399 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1400 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1398 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2777 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2778 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2779 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2780 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2781 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2782 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Date Public
    2019-03-06 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:15.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E"
          },
          {
            "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E"
          },
          {
            "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
          },
          {
            "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
          },
          {
            "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E"
          },
          {
            "name": "108044",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108044"
          },
          {
            "name": "RHSA-2019:0886",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0886"
          },
          {
            "name": "RHSA-2019:1399",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1399"
          },
          {
            "name": "RHSA-2019:1400",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1400"
          },
          {
            "name": "RHSA-2019:1398",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1398"
          },
          {
            "name": "RHSA-2019:2777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2777"
          },
          {
            "name": "RHSA-2019:2778",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2778"
          },
          {
            "name": "RHSA-2019:2779",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2779"
          },
          {
            "name": "RHSA-2019:2780",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2780"
          },
          {
            "name": "RHSA-2019:2781",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2781"
          },
          {
            "name": "RHSA-2019:2782",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2782"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Qpid Proton",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "0.9 to 0.27.0"
            }
          ]
        }
      ],
      "datePublic": "2019-03-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Man-in-the-middle Attack",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-20T13:06:22.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E"
        },
        {
          "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E"
        },
        {
          "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
        },
        {
          "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
        },
        {
          "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E"
        },
        {
          "name": "108044",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108044"
        },
        {
          "name": "RHSA-2019:0886",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0886"
        },
        {
          "name": "RHSA-2019:1399",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1399"
        },
        {
          "name": "RHSA-2019:1400",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1400"
        },
        {
          "name": "RHSA-2019:1398",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1398"
        },
        {
          "name": "RHSA-2019:2777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2777"
        },
        {
          "name": "RHSA-2019:2778",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2778"
        },
        {
          "name": "RHSA-2019:2779",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2779"
        },
        {
          "name": "RHSA-2019:2780",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2780"
        },
        {
          "name": "RHSA-2019:2781",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2781"
        },
        {
          "name": "RHSA-2019:2782",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2782"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2019-0223",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Qpid Proton",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "0.9 to 0.27.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Man-in-the-middle Attack"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b@%3Cdev.qpid.apache.org%3E"
            },
            {
              "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5@%3Cdev.qpid.apache.org%3E"
            },
            {
              "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
            },
            {
              "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f@%3Cusers.qpid.apache.org%3E"
            },
            {
              "name": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel",
              "refsource": "MISC",
              "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
            },
            {
              "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E"
            },
            {
              "name": "108044",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108044"
            },
            {
              "name": "RHSA-2019:0886",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0886"
            },
            {
              "name": "RHSA-2019:1399",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1399"
            },
            {
              "name": "RHSA-2019:1400",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1400"
            },
            {
              "name": "RHSA-2019:1398",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1398"
            },
            {
              "name": "RHSA-2019:2777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2777"
            },
            {
              "name": "RHSA-2019:2778",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2778"
            },
            {
              "name": "RHSA-2019:2779",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2779"
            },
            {
              "name": "RHSA-2019:2780",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2780"
            },
            {
              "name": "RHSA-2019:2781",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2781"
            },
            {
              "name": "RHSA-2019:2782",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2782"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2019-0223",
    "datePublished": "2019-04-23T15:57:07.000Z",
    "dateReserved": "2018-11-14T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:44:15.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-0223 (GCVE-0-2019-0223)

    Vulnerability from cvelistv5 – Published: 2019-04-23 15:57 – Updated: 2024-08-04 17:44
    VLAI
    Summary
    While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
    Severity
    No CVSS data available.
    CWE
    • Man-in-the-middle Attack
    Assigner
    References
    URL Tags
    https://lists.apache.org/thread.html/49c83f0acce5… mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/3adb2f020f70… mailing-listx_refsource_MLIST
    http://www.openwall.com/lists/oss-security/2019/04/23/4 mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/d9c9a882a292… mailing-listx_refsource_MLIST
    https://lists.apache.org/thread.html/008ee5e78e5a… mailing-listx_refsource_MLIST
    https://issues.apache.org/jira/browse/PROTON-2014… x_refsource_MISC
    https://lists.apache.org/thread.html/914424e4d798… mailing-listx_refsource_MLIST
    http://www.securityfocus.com/bid/108044 vdb-entryx_refsource_BID
    https://access.redhat.com/errata/RHSA-2019:0886 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1399 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1400 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:1398 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2777 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2778 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2779 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2780 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2781 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2019:2782 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Date Public
    2019-03-06 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:15.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E"
          },
          {
            "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E"
          },
          {
            "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
          },
          {
            "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
          },
          {
            "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E"
          },
          {
            "name": "108044",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108044"
          },
          {
            "name": "RHSA-2019:0886",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0886"
          },
          {
            "name": "RHSA-2019:1399",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1399"
          },
          {
            "name": "RHSA-2019:1400",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1400"
          },
          {
            "name": "RHSA-2019:1398",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1398"
          },
          {
            "name": "RHSA-2019:2777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2777"
          },
          {
            "name": "RHSA-2019:2778",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2778"
          },
          {
            "name": "RHSA-2019:2779",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2779"
          },
          {
            "name": "RHSA-2019:2780",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2780"
          },
          {
            "name": "RHSA-2019:2781",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2781"
          },
          {
            "name": "RHSA-2019:2782",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2782"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Qpid Proton",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "0.9 to 0.27.0"
            }
          ]
        }
      ],
      "datePublic": "2019-03-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Man-in-the-middle Attack",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-20T13:06:22.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E"
        },
        {
          "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E"
        },
        {
          "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
        },
        {
          "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
        },
        {
          "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E"
        },
        {
          "name": "108044",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108044"
        },
        {
          "name": "RHSA-2019:0886",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0886"
        },
        {
          "name": "RHSA-2019:1399",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1399"
        },
        {
          "name": "RHSA-2019:1400",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1400"
        },
        {
          "name": "RHSA-2019:1398",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1398"
        },
        {
          "name": "RHSA-2019:2777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2777"
        },
        {
          "name": "RHSA-2019:2778",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2778"
        },
        {
          "name": "RHSA-2019:2779",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2779"
        },
        {
          "name": "RHSA-2019:2780",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2780"
        },
        {
          "name": "RHSA-2019:2781",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2781"
        },
        {
          "name": "RHSA-2019:2782",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2782"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2019-0223",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Qpid Proton",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "0.9 to 0.27.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Man-in-the-middle Attack"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b@%3Cdev.qpid.apache.org%3E"
            },
            {
              "name": "[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5@%3Cdev.qpid.apache.org%3E"
            },
            {
              "name": "[oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/04/23/4"
            },
            {
              "name": "[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f@%3Cusers.qpid.apache.org%3E"
            },
            {
              "name": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel",
              "refsource": "MISC",
              "url": "https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel"
            },
            {
              "name": "qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E"
            },
            {
              "name": "108044",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108044"
            },
            {
              "name": "RHSA-2019:0886",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0886"
            },
            {
              "name": "RHSA-2019:1399",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1399"
            },
            {
              "name": "RHSA-2019:1400",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1400"
            },
            {
              "name": "RHSA-2019:1398",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1398"
            },
            {
              "name": "RHSA-2019:2777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2777"
            },
            {
              "name": "RHSA-2019:2778",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2778"
            },
            {
              "name": "RHSA-2019:2779",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2779"
            },
            {
              "name": "RHSA-2019:2780",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2780"
            },
            {
              "name": "RHSA-2019:2781",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2781"
            },
            {
              "name": "RHSA-2019:2782",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2782"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2019-0223",
    "datePublished": "2019-04-23T15:57:07.000Z",
    "dateReserved": "2018-11-14T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:44:15.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}