PT-2018-2675 · Apache · Apache Qpid Proton

Peter Stockli · Published 2018-11-12 · Updated 2019-01-31 · CVE-2018-17187

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-J versions 0.3 through 0.29.0

Description The issue is related to the TLS wrapper layer in the Apache Qpid Proton-J transport, which did not properly verify peer certificates, making clients vulnerable to Man In The Middle (MITM) attacks. The problem occurred because the hostname verification mode was not implemented in versions 0.3 to 0.29.0, leaving only the option to verify if the certificate is trusted. This vulnerability can be exploited by a remote attacker to perform a MITM attack.

Recommendations For Apache Qpid Proton-J versions 0.3 through 0.29.0, upgrade to version 0.30.0 or later and use the VerifyMode#VERIFY PEER NAME configuration to enable hostname verification. As a temporary workaround, consider disabling the use of the transport TLS wrapper layer until a patch is available. Restrict access to the vulnerable TLS wrapper layer to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2019-01322

CVE-2018-17187

GHSA-XVCH-R4WF-H8W9

Affected Products

Apache Qpid Proton

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2018-17187 · Security Note
• https://issues.apache.org/jira/browse/PROTON-1962 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-17187 · Vendor Advisory
• https://qpid.apache.org/cves/CVE-2018-17187.html · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-17187 · Security Note
• https://osv.dev/vulnerability/GHSA-xvch-r4wf-h8w9 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17187 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-17187 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01322 · Security Note
• https://ubuntu.com/security/CVE-2018-17187 · Vendor Advisory
• https://github.com/apache/qpid-proton-j/commit/0cb8ca03cec42120dcfc434561592d89a89a805e · Note
• https://securitylab.ru/vulnerability/496557.php · Note
• https://github.com/advisories/GHSA-xvch-r4wf-h8w9 · Note