Justin Ross

**Name of the Vulnerable Software and Affected Versions** Apache Qpid Proton library versions prior to 0.13.1 **Description** The issue concerns the C client and C-based client bindings in the Apache Qpid Proton library, which do not properly verify the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This occurs when using the SChannel-based security layer on Windows, allowing man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. **Recommendations** For Apache Qpid Proton library versions prior to 0.13.1, update to version 0.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SChannel-based security layer until a patch is applied.