Improper Certificate Validation Affecting qpid_proton package, versions >=0.9, <0.27.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-QPIDPROTON-3097690
- published 26 Jan 2022
- disclosed 23 Apr 2019
- credit Qpid developers
Introduced: 23 Apr 2019
CVE-2019-0223 Open this link in a new tabHow to fix?
Upgrade qpid_proton to version 0.27.1 or higher.
Overview
qpid_proton is a Proton is a high performance, lightweight messaging library. It can be used in the widest range of messaging applications including brokers, client libraries, routers, bridges, proxies, and more. Proton is based on the AMQP 1.0 messaging standard.
Affected versions of this package are vulnerable to Improper Certificate Validation. Under some circumstances, Apache Qpid Proton (The C library and its language bindings) can connect to a peer anonymously using TLS, even when configured to verify the peer certificate, while used with OpenSSL versions before 1.1.0. Exploiting this vulnerability is possible if an attacker can arrange to intercept TLS traffic.