PT-2017-8498 · Apache+1 · Apache Qpid Proton+1

Justin Ross · Publicado 2017-05-02 · Atualizado 2024-04-05 · CVE-2016-4467

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton library versions prior to 0.13.1

Description The issue concerns the C client and C-based client bindings in the Apache Qpid Proton library, which do not properly verify the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This occurs when using the SChannel-based security layer on Windows, allowing man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Recommendations For Apache Qpid Proton library versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SChannel-based security layer until a patch is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2016-3246

CVE-2016-4467

Produtos afetados

Alt Linux

Apache Qpid Proton

Referências · 6

• http://securitytracker.com/id/1036316 · Nota
• https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2016-4467 · Aviso do Fabricante
• http://securityfocus.com/bid/91788 · Nota
• http://openwall.com/lists/oss-security/2016/07/15/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4467 · Nota de Segurança