https://bugzilla.redhat.com/show_bug.cgi?id=1320842
Bug ID: 1320842
Summary: CVE-2016-2166 qpid-proton: reactor sends messages in
clear if ssl is requested but not available
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abaron(a)redhat.com, aortega(a)redhat.com,
apevec(a)redhat.com, ayoung(a)redhat.com,
bkearney(a)redhat.com, chrisw(a)redhat.com,
cpelland(a)redhat.com, dallan(a)redhat.com,
esammons(a)redhat.com, gkotton(a)redhat.com,
iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jross(a)redhat.com, jschluet(a)redhat.com,
kgiusti(a)gmail.com, kpalko(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, markmc(a)redhat.com,
mcressma(a)redhat.com, messaging-bugs(a)redhat.com,
mmccune(a)redhat.com, ohadlevy(a)redhat.com,
pmyers(a)redhat.com, puntogil(a)libero.it,
rbryant(a)redhat.com, rhos-maint(a)redhat.com,
rrajasek(a)redhat.com, satellite6-bugs(a)redhat.com,
sclewis(a)redhat.com, tdecacqu(a)redhat.com,
tjay(a)redhat.com, tlestach(a)redhat.com
Messaging applications using the Proton Python API to provision an SSL/TLS
encrypted TCP connection may actually instantiate a non-encrypted connection
without notice if SSL support is unavailable. This will result in all messages
being sent in the clear without the knowledge of the user.
This issue affects those applications that use the Proton Reactor Python API to
create SSL/TLS connections. Specifically the proton.reactor.Connector,
proton.reactor.Container, and proton.utils.BlockingConnection classes are
vulnerable. These classes can create an unencrypted connections if the
"amqps://" URL prefix is used.
The issue only occurs if the installed Proton libraries do not support SSL.
This would be the case if the libraries were built without SSL support or the
necessary SSL libraries are not present on the system (e.g. OpenSSL in the case
of *nix).
References:
http://seclists.org/bugtraq/2016/Mar/166
Upstream fix:
https://issues.apache.org/jira/browse/PROTON-1157
Upstream fixed release:
http://qpid.apache.org/releases/qpid-proton-0.12.1/
--
You are receiving this mail because:
You are on the CC list for the bug.