qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Important: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat Satellite 6.5 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

The vulnerability of the Apache Qpid Proton library, related to errors in the certificate validation process, allows a perpetrator to execute a “man-in-the-middle” attack and intercept TLS traffic.

The vulnerability of the Apache Qpid Proton library is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack and intercept TLS traffic by anonymously connecting to a single-ridged node using TLS...

Moderate: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat OpenStack Platform 14 Rocky. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Moderate: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: qpid-proton security update

An update for qpid-proton is now available for Red Hat OpenStack Platform 14 Rocky. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Improper Access Control

Red Hat Satellite is vulnerable to improper access control vulnerability. The vulnerability exists in the message queues maintained by Satellite's QPID broker and used by katello-agent. A malicious user with authentication to a host registered to Satellite could execute privilege commands to acce...

Denial Of Service (DoS)

Apache Qpid Dispatch Router is vulnerable to denial of service attacks. A remote, authenticated attacker could exploit the flawed JAMQP component to cause denial of service conditions via a specifically crafted AMQP frame which will cause a segfault and shut down...

RHEL 5 / 6 / 7 / 8 : Red Hat Satellite Tools (RHSA-2019:1223)

The remote Redhat Enterprise Linux 5 / 6 / 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1223 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and...

Authentication Bypass

Red Hat Enterprise MRG Messaging, Realtime, and Grid is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. The Qpid packages provide a message broker daemon that receives,...

Denial Of Service (DoS)

Red Hat Enterprise MRG Messaging, Realtime, and Grid is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. The Qpid packages provide a message broker daemon that receives,...

Privilege Escalation

OpenStack Compute nova launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, an...

Denial Of Service (DoS)

qpid is vulnerable to denial of service. It was found that the AMQP type decoder in qpidd allowed arbitrary data types in certain messages. A remote attacker could use this flaw to send a message containing an excessively large amount of data, causing qpidd to allocate a large amount of memory an...

Denial Of Service (DoS)

qpid is vulnerable to denial of service. An integer overflow flaw, leading to an out-of-bounds read, was found in the Qpid qpid::framing::Buffer::checkAvailable function. An unauthenticated, remote attacker could send a specially-crafted message to Qpid, causing it to crash...

qpid-proton: TLS Man in the Middle Vulnerability

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...

Improper TLS Certificate Validation

Apache Qpid Proton is vulnerable to man-in-the-middle MitM attacks. A remote attacker is able to intercept TLS traffic as the application provides anonymous ciphers to authenticate a client regardless of the client's configuration to verify the server's certificate or hostname. The vulnerability ...