VYPR
← All advisories
High severity7.4NVD Advisory· Published Apr 23, 2019· Updated Jun 17, 2026

CVE-2019-0223

CVE-2019-0223

Description

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.qpid:proton-jMaven
>= 0.9, < 0.27.10.27.1

Affected products

35
  • Apache/Qpid
    cpe:2.3:a:apache:qpid:*:*:*:*:*:*:*:*
    Range: >=0.9,<=0.27.0
  • Red Hat/Jboss Amq Clients 2
    cpe:2.3:a:redhat:jboss_amq_clients_2:-:*:*:*:*:*:*:*
  • Red Hat/Openstack2 versions
    cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*
  • Red Hat/Satellite3 versions
    cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:satellite:6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.5:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Desktop2 versions
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Eus6 versions
    cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server2 versions
    cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server Aus8 versions
    cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Server Tus4 versions
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Workstation2 versions
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  • ghsa-coords3 versions
    pkg:maven/org.apache.qpid/proton-jpkg:rpm/opensuse/qpid-proton&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/qpid-proton&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5
    >= 0.9, < 0.27.1+ 2 more
    • (no CPE)range: >= 0.9, < 0.27.1
    • (no CPE)range: < 0.38.0-150000.6.3.1
    • (no CPE)range: < 0.38.0-150000.6.3.1
  • Apache/Qpid Protoncpe-rescue
    Range: 0.9 to 0.27.0

Patches

Vulnerability mechanics

References

25

News mentions

0

No linked articles in our index yet.

CVE-2019-0223 · High · VYPR