CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
43.4%
The Apache Qpid Proton-J transport includes an optional wrapper layer to
perform TLS, enabled by use of the ‘transport.ssl(…)’ methods. Unless a
verification mode was explicitly configured, client and server modes
previously defaulted as documented to not verifying a peer certificate,
with options to configure this explicitly or select a certificate
verification mode with or without hostname verification being performed.
The latter hostname verifying mode was not implemented in Apache Qpid
Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an
exception. This left only the option to verify the certificate is trusted,
leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses
of the Proton-J protocol engine which do not utilise the optional transport
TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J
utilising the optional transport TLS wrapper layer that wish to enable
hostname verification must be upgraded to version 0.30.0 or later and
utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the
default for client mode usage unless configured otherwise.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | qpid-proton | < any | UNKNOWN |
ubuntu | 16.04 | noarch | qpid-proton | < any | UNKNOWN |
github.com/apache/qpid-proton-j/commit/0cb8ca03cec42120dcfc434561592d89a89a805e
issues.apache.org/jira/browse/PROTON-1962
launchpad.net/bugs/cve/CVE-2018-17187
mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E
nvd.nist.gov/vuln/detail/CVE-2018-17187
qpid.apache.org/cves/CVE-2018-17187.html
security-tracker.debian.org/tracker/CVE-2018-17187
www.cve.org/CVERecord?id=CVE-2018-17187
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
43.4%