CVE-2019-0223

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-0223
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www.openwall.com/lists/oss-security/2019/04/23/4 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/108044 Broken Link
https://access.redhat.com/errata/RHSA-2019:0886 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1398 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1399 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1400 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2777 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2778 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2779 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2780 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2781 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2782 Third Party Advisory
https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel Issue Tracking Vendor Advisory
https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E
https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E
https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E
https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E
https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:redhat:jboss_amq_clients_2:-:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
History

07 Nov 2023, 03:01

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f@%3Cusers.qpid.apache.org%3E', 'name': '[SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability', 'tags': ['Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E', 'name': 'qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223', 'tags': ['Mailing List', 'Patch', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b@%3Cdev.qpid.apache.org%3E', 'name': '[qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability', 'tags': ['Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5@%3Cdev.qpid.apache.org%3E', 'name': '[qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability', 'tags': ['Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • {'url': 'https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0@%3Cannounce.apache.org%3E', 'name': '[announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability', 'tags': ['Mailing List', 'Vendor Advisory'], 'refsource': 'MLIST'}
  • () https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E -
  • () https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E -
  • () https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E -
  • () https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E -
  • () https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E -

22 Apr 2022, 20:09

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
CWE CWE-295 NVD-CWE-noinfo
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2780 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2780 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:1398 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:1398 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2778 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2778 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/108044 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/108044 - Broken Link
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2781 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2781 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:1399 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:1399 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2777 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2777 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2782 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2782 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2779 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2779 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:1400 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:1400 - Third Party Advisory
First Time Redhat satellite
Redhat enterprise Linux Desktop
Redhat enterprise Linux Server
Redhat enterprise Linux Eus
Redhat enterprise Linux Server Tus
Redhat enterprise Linux Workstation
Redhat enterprise Linux Server Aus
Redhat openstack
CVSS v2 : 4.0
v3 : 7.4 		v2 : 5.8
v3 : 7.4
Information

Published : 2019-04-23 16:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-0223

Mitre link : CVE-2019-0223

CVE.ORG link : CVE-2019-0223

JSON object : View

Products Affected

redhat

  • enterprise_linux_server
  • enterprise_linux_eus
  • enterprise_linux_desktop
  • enterprise_linux_server_aus
  • enterprise_linux_server_tus
  • enterprise_linux_workstation
  • openstack
  • jboss_amq_clients_2
  • satellite
  • linux

apache

  • qpid
CWE
NVD-CWE-noinfo