CVE-2018-17187
Summary
| CVE | CVE-2018-17187 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-11-13 15:29:00 UTC |
|---|
| Updated | 2019-01-31 19:10:00 UTC |
|---|
| Description | The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Apache Qpid Proton-J CVE-2018-17187 Certificate Validation Security Bypass Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| [PROTON-1962] [CVE-2018-17187] transport TLS wrapper hostname verification mode not implemented - ASF JIRA |
MISC |
issues.apache.org |
Vendor Advisory |
| CVE-2018-17187: transport TLS wrapper hostname verification mode not implemented - Apache Qpid™ |
MISC |
qpid.apache.org |
Mitigation, Vendor Advisory |
| [SECURITY] [CVE-2018-17187] Apache Qpid Proton-J transport TLS wrapper hostname verification mode not implemented |
MISC |
mail-archives.apache.org |
Mailing List, Mitigation, Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980776 Java (maven) Security Update for org.apache.qpid:proton-j (GHSA-xvch-r4wf-h8w9)
