Default configuration

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

DEBIAN-CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

CVE-2018-17187

CVE-2018-17187 affects the Apache Qpid Proton-J TLS wrapper. Versions 0.3–0.29.0 lacked hostname verification support, leaving clients that rely on the wrapper with only trusted-certificate verification and exposing them to MITM attacks. The mitigation is to upgrade Proton-J to 0.30.0+ and enable...

CVE-2018-17187

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

Man-in-the-middle (MitM) Attacks

Apache Qpid Proton-J transport is vulnerable to man-in-the-middle attack. The attack is possible since it passes all the certificates as trusted by default if a verification mode is not specifically set...

CVE-2018-17187: Improper Certificate Validation

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...

PT-2018-2675

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-J versions 0.3 through 0.29.0 Description The issue is related to the TLS wrapper layer in the Apache Qpid Proton-J transport, which did not properly verify peer certificates, making clients vulnerable to Man In The Middle...

com.github.jep42:robotframework-easycsvmap-remoteserver (>=0.0.2, <=0.0.5), com.github.jep42:robotframework-formatcompare-remoteserver (>=0.0.2, <=0.0.3) +63 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.3.v20120416)

org.eclipse.jetty:jetty-server MAVEN version 7.6.3.v20120416 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.jep42:robotframework-easycsvmap-remoteserver =0.0.2, =0.0.2, =2.0-beta, =0.18,...

GHSA-6W3V-66MJ-2QM6 Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQ...

Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQ...

GHSA-4R7G-7CPJ-5JR7 Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 inclusive the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are...

com.holidaycheck:amqp-akka-streams_2.11 (>=1.3.1, <=2.0.0), com.holidaycheck:amqp-akka-streams_2.12 (>=1.3.1, <=2.0.0) +1 more potentially affected by CVE-2017-15701 via org.apache.qpid:qpid-broker (>=6.1.3, <=6.1.4)

org.apache.qpid:qpid-broker MAVEN version =6.1.3, =1.3.1, =1.3.1, =0.0.1, =0.0.35 Source cves: CVE-2017-15701 Source advisory: OSV:GHSA-4R7G-7CPJ-5JR7...

Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 inclusive the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are...

com.holidaycheck:amqp-akka-streams_2.11 (>=1.3.1, <=2.0.0), com.holidaycheck:amqp-akka-streams_2.12 (>=1.3.1, <=2.0.0) +1 more potentially affected by CVE-2017-15701 via org.apache.qpid:qpid-broker (>=6.1.3, <=6.1.4)

org.apache.qpid:qpid-broker MAVEN version =6.1.3, =1.3.1, =1.3.1, =0.0.1, =0.0.35 Source cves: CVE-2017-15701 Source advisory: GHSA-4R7G-7CPJ-5JR7...

Apache Qpid Broker vulnerable to authentication port spoofing

Apache Qpid Broker-J versions 0.18 through 0.32 are vulnerable to authentication port spoofing. When the broker is configured with different authentication providers on different ports, one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to...

com.confluex:qpid-in-a-can (0.2.0), com.dell.cpsd.common.messaging:common-testing (1.5.0) +21 more potentially affected by CVE-2017-15702 via org.apache.qpid:qpid-broker (>=0.18, <=0.32)

org.apache.qpid:qpid-broker MAVEN version =0.18, =2.0.0, =1.0.0, =0.1, =0.1, =0.18, =0.18, =0.18, =0.24 - org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol 0.24 - org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol 0.24 - org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol 0.24 -...

GHSA-269M-695X-J34P Apache Qpid Broker vulnerable to authentication port spoofing

Apache Qpid Broker-J versions 0.18 through 0.32 are vulnerable to authentication port spoofing. When the broker is configured with different authentication providers on different ports, one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to...