CVE-2018-17187

{"id": "CVE-2018-17187", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2018-11-13T15:29:00.313", "references": [{"url": "http://www.securityfocus.com/bid/105935", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@apache.org"}, {"url": "https://issues.apache.org/jira/browse/PROTON-1962", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E", "tags": ["Mitigation", "Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://qpid.apache.org/cves/CVE-2018-17187.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise."}, {"lang": "es", "value": "El transporte de Apache Qpid Proton-J incluye una capa wrapper opcional para realizar TLS, habilitado por el uso de los m\u00e9todos \"transport.ssl(...)\". A menos que hubiese un modo de verificaci\u00f3n expl\u00edcito, los modos cliente y servidor se consideraban por defecto como documentados para as\u00ed no verificar el certificado peer, con opciones para configurar esto de forma expl\u00edcita o seleccionar un modo de verificaci\u00f3n de certificado con o sin un proceso de verificaci\u00f3n de nombres de host. Este \u00faltimo modo de verificaci\u00f3n de nombres de host no se implement\u00f3 en Apache Qpid Proton-J, de la versi\u00f3n 0.3 a la 0.29.0; los intentos para emplearlo resultaron en una excepci\u00f3n. Esto solo dej\u00f3 una opci\u00f3n para verificar que se conf\u00eda en el certificado, dejando que el cliente sea vulnerable a un ataque Man-in-the-Middle (MitM). Los usos del motor del protocolo Proton-J que no emplean el wrapper opcional de transporte TLS no se han visto impactados (p. ej., su uso en Qpid JMS). Los usos de Proton-J que empleen la capa wrapper opcional de transporte TLS que deseen habilitar la verificaci\u00f3n de nombres de host deben actualizarse a la versi\u00f3n 0.30.0 o posteriores y emplear la configuraci\u00f3n VerifyMode#VERIFY_PEER_NAME, que ahora es la predeterminada para el uso del modo cliente a no ser que se configure de otra forma."}], "lastModified": "2019-01-31T19:10:53.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:qpid_proton-j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62762E8D-905E-46EB-9C97-3CE19EB8443F", "versionEndIncluding": "0.29.0", "versionStartIncluding": "0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}