CVE-2019-0223

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton versions 0.9 through 0.27.0

Description The issue is related to errors in the certificate authentication procedure, allowing a remote attacker to implement a man-in-the-middle attack and intercept TLS traffic by anonymously connecting to a peer node using TLS, even when configured to verify the peer certificate. This can be achieved when used with OpenSSL versions before 1.1.0.

Recommendations For Apache Qpid Proton versions 0.9 through 0.27.0, consider disabling the use of TLS anonymous connections until a patch is available. Restrict access to the TLS configuration to minimize the risk of exploitation. Avoid using OpenSSL versions before 1.1.0 with Apache Qpid Proton to reduce the vulnerability to man-in-the-middle attacks.