PT-2017-8498 · Apache+1 · Apache Qpid Proton+1

Justin Ross · Published 2017-05-02 · Updated 2024-04-05 · CVE-2016-4467

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton library versions prior to 0.13.1

Description The issue concerns the C client and C-based client bindings in the Apache Qpid Proton library, which do not properly verify the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This occurs when using the SChannel-based security layer on Windows, allowing man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Recommendations For Apache Qpid Proton library versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SChannel-based security layer until a patch is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2016-3246

CVE-2016-4467

Affected Products

Alt Linux

Apache Qpid Proton

References · 6

• https://osv.dev/vulnerability/CVE-2016-4467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4467 · Security Note
• http://securitytracker.com/id/1036316 · Note
• https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E · Note
• http://securityfocus.com/bid/91788 · Note
• http://openwall.com/lists/oss-security/2016/07/15/3 · Note