https://bugzilla.redhat.com/show_bug.cgi?id=1651837
Bug ID: 1651837
Summary: CVE-2018-17187 qpid-proton-java: Hostname verification
mode not implemented in transport TLS wrapper
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, avibelli(a)redhat.com,
bgeorges(a)redhat.com, chazlett(a)redhat.com,
esammons(a)redhat.com, hghasemb(a)redhat.com,
iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jpallich(a)redhat.com,
jross(a)redhat.com, jshepherd(a)redhat.com,
krathod(a)redhat.com, lthon(a)redhat.com,
mcressma(a)redhat.com, mszynkie(a)redhat.com,
pgallagh(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rruss(a)redhat.com,
trogers(a)redhat.com
The Proton-J transport includes an optional wrapper layer to perform TLS,
enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode
was explicitly configured, client and server modes previously defaulted as
documented to not verifying a peer certificate, with options to configure this
explicitly or select a certificate verification mode with or without hostname
verification being performed.
The latter hostname verifying mode was not previously implemented, with
attempts to use it resulting in an exception. This left only the option to
verify the certificate is trusted, leaving such a client vulnerable to Man In
The Middle (MITM) attack.
Uses of the Proton-J protocol engine which do not utilise the optional
transport TLS wrapper are not impacted, e.g. usage within Qpid JMS.
External References:
https://qpid.apache.org/cves/CVE-2018-17187.html
https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFit...
Upstream Bug:
https://issues.apache.org/jira/browse/PROTON-1962
Upstream Patch:
https://git-wip-us.apache.org/repos/asf?p=qpid-proton-j.git;h=0cb8ca0
--
You are receiving this mail because:
You are on the CC list for the bug.