qpid-proton: TLS Man in the Middle Vulnerability
Published Apr 23, 2019
7.4
HIGHCVSS 3.1
EPSS 6.20%
Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
Affected products
-
- Version 0.9 to 0.27.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton | n/a |
|
Configuration 2
Configuration 3
- 13
- 14
- 6.3
- 6.4
- 6.5
- 6.0
- 7.0
- 6.7
- 7.2
- 7.3
- 7.4
- 7.5
- 7.6
- 6.0
- 7.0
- 5.9
- 6.4
- 6.5
- 6.6
- 7.2
- 7.3
- 7.4
- 7.6
- 7.2
- 7.3
- 7.4
- 7.6
- 6.0
- 7.0
No data.
AMQ Clients 2.y for RHEL 6
qpid-proton-0:0.27.0-3.el6
Fixed · RHSA-2019:0886
AMQ Clients 2.y for RHEL 7
qpid-proton-0:0.27.0-3.el7
Fixed · RHSA-2019:0886
CloudForms Management Engine 5.11
ansible-runner-0:1.3.4-2.el8ar
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ansible-tower-0:3.5.2-1.el8at
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
cfme-0:5.11.0.28-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
cfme-amazon-smartstate-0:5.11.0.28-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
cfme-appliance-0:5.11.0.28-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
cfme-gemset-0:5.11.0.28-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-cluster-upgrade-0:1.1.13-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-disaster-recovery-0:1.2.0-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-engine-setup-0:1.1.9-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-hosted-engine-setup-0:1.0.26-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-image-template-0:1.1.11-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-infra-0:1.1.12-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-manageiq-0:1.1.14-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-repositories-0:1.1.5-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-roles-0:1.1.7-2.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-shutdown-env-0:1.0.3-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
ovirt-ansible-vm-infra-0:1.1.19-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
prince-0:12.4-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-bambou-0:3.0.1-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-colorama-0:0.4.1-1.el8ost
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-daemon-0:2.1.2-9.el8ar
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-funcsigs-0:1.0.2-3.el8ost
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-future-0:0.16.0-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-lockfile-1:0.11.0-8.el8ar
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-mock-0:2.0.0-11.el8ost
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-pbr-0:5.1.2-2.el8ost
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-pexpect-0:4.6-2.el8ar
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-psutil-0:5.4.3-5.el8ar
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-pylxca-0:2.1.1-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-requests-toolbelt-0:0.8.0-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-tabulate-0:0.8.2-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python-vspk-0:5.3.2-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
python3-ovirt-engine-sdk4-0:4.3.2-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
qpid-proton-0:0.28.0-1.el8
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
repmgr10-0:4.0.6-3.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-bcrypt-0:3.1.13-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-byebug-0:11.0.1-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-escape_utils-0:1.2.1-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-ffi-0:1.9.25-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-hamlit-0:2.8.10-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-http_parser.rb-0:0.6.0-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-linux_block_device-0:0.2.1-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-memory_buffer-0:0.1.0-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-nio4r-0:2.4.0-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-nokogiri-0:1.8.5-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-ovirt-engine-sdk4-0:4.3.0-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-puma-0:3.7.1-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-qpid_proton-0:0.26.0-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-rugged-0:0.28.2-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-sassc-0:2.0.1-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-sqlite3-0:1.3.13-2.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-surro-gate-0:1.0.5-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-unf_ext-0:0.0.7.6-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
rubygem-websocket-driver-0:0.6.5-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
smem-0:1.4-1.el8cf
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
v2v-conversion-host-0:1.14.2-1.el8ev
Fixed · RHBA-2019:4199
CloudForms Management Engine 5.11
wmi-0:1.3.14-8.el8cf
Fixed · RHBA-2019:4199
Red Hat OpenStack Platform 13.0 (Queens)
jsoncpp-0:1.7.7-1.el7
Fixed · RHSA-2019:1400
Red Hat OpenStack Platform 13.0 (Queens)
qpid-proton-0:0.27.0-3.el7
Fixed · RHSA-2019:1400
Red Hat OpenStack Platform 14.0 (Rocky)
qpid-proton-0:0.27.0-3.el7
Fixed · RHSA-2019:1399
Red Hat OpenStack Platform 14.0 Operational Tools for RHEL 7
qpid-proton-0:0.27.0-3.el7
Fixed · RHSA-2019:1398
Red Hat Satellite 6.3 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2779
Red Hat Satellite 6.3 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2779
Red Hat Satellite 6.4 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2778
Red Hat Satellite 6.4 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2778
Red Hat Satellite 6.5 for RHEL 7
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2777
Red Hat Satellite 6.5 for RHEL 7
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2777
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.3 for RHEL 5.9.AUS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 5.ELS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 6
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 6.4.AUS
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 6.5.AUS
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 6.6.AUS
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 6.7.EUS
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.2.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.2.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.2.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.3.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.3.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.3.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.4.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.4.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.4.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.5.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.6.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.6.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.3 for RHEL 7.6.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2781
Satellite Tools 6.4 for RHEL 5.9.AUS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 5.ELS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 6
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 6.7.EUS
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.2.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.2.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.2.TUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.3.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.3.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.3.TUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.4.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.4.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.4.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.4.TUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.5.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.6.AUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.6.E4S
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.6.EUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.4 for RHEL 7.6.TUS
qpid-proton-0:0.16.0-14.el7sat
Fixed · RHSA-2019:2782
Satellite Tools 6.5 for RHEL 5.9.AUS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 5.ELS
qpid-proton-0:0.9-22.el5
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 6
qpid-proton-0:0.16.0-14.el6sat
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.2.AUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.2.E4S
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.2.TUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.3.AUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.3.E4S
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.3.TUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.4.AUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.4.E4S
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.4.EUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.4.TUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.5.EUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.6.AUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.6.E4S
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.6.EUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 7.6.TUS
qpid-proton-0:0.28.0-1.el7
Fixed · RHSA-2019:2780
Satellite Tools 6.5 for RHEL 8
qpid-proton-0:0.28.0-1.el8
Fixed · RHSA-2019:2780
A-MQ Interconnect 1
qpid-proton
Affected
Red Hat AMQ Broker 7
qpid-proton
Not affected
Red Hat Enterprise MRG 3
qpid-proton
Will not fix
Red Hat Fuse 7
proton-j
Not affected
Red Hat JBoss A-MQ 6
proton-j
Out of support scope
Red Hat JBoss Fuse 6
proton-j
Out of support scope
Red Hat OpenShift Application Runtimes
proton-j
Affected
Red Hat OpenStack Platform 8 (Liberty)
qpid-proton
Will not fix
Red Hat Update Infrastructure 3 for Cloud Providers
qpid-proton
Will not fix
Red Hat Virtualization 4
redhat-virtualization-host
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| AMQ Clients 2.y for RHEL 6 | qpid-proton-0:0.27.0-3.el6 | Fixed | RHSA-2019:0886 |
| AMQ Clients 2.y for RHEL 7 | qpid-proton-0:0.27.0-3.el7 | Fixed | RHSA-2019:0886 |
| CloudForms Management Engine 5.11 | ansible-runner-0:1.3.4-2.el8ar | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ansible-tower-0:3.5.2-1.el8at | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | cfme-0:5.11.0.28-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | cfme-amazon-smartstate-0:5.11.0.28-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | cfme-appliance-0:5.11.0.28-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | cfme-gemset-0:5.11.0.28-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-cluster-upgrade-0:1.1.13-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-disaster-recovery-0:1.2.0-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-engine-setup-0:1.1.9-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-hosted-engine-setup-0:1.0.26-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-image-template-0:1.1.11-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-infra-0:1.1.12-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-manageiq-0:1.1.14-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-repositories-0:1.1.5-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-roles-0:1.1.7-2.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-shutdown-env-0:1.0.3-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | ovirt-ansible-vm-infra-0:1.1.19-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | prince-0:12.4-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-bambou-0:3.0.1-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-colorama-0:0.4.1-1.el8ost | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-daemon-0:2.1.2-9.el8ar | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-funcsigs-0:1.0.2-3.el8ost | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-future-0:0.16.0-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-lockfile-1:0.11.0-8.el8ar | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-mock-0:2.0.0-11.el8ost | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-pbr-0:5.1.2-2.el8ost | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-pexpect-0:4.6-2.el8ar | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-psutil-0:5.4.3-5.el8ar | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-pylxca-0:2.1.1-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-requests-toolbelt-0:0.8.0-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-tabulate-0:0.8.2-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python-vspk-0:5.3.2-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | python3-ovirt-engine-sdk4-0:4.3.2-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | qpid-proton-0:0.28.0-1.el8 | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | repmgr10-0:4.0.6-3.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-bcrypt-0:3.1.13-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-byebug-0:11.0.1-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-escape_utils-0:1.2.1-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-ffi-0:1.9.25-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-hamlit-0:2.8.10-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-http_parser.rb-0:0.6.0-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-linux_block_device-0:0.2.1-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-memory_buffer-0:0.1.0-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-nio4r-0:2.4.0-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-nokogiri-0:1.8.5-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-ovirt-engine-sdk4-0:4.3.0-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-puma-0:3.7.1-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-qpid_proton-0:0.26.0-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-rugged-0:0.28.2-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-sassc-0:2.0.1-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-sqlite3-0:1.3.13-2.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-surro-gate-0:1.0.5-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-unf_ext-0:0.0.7.6-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | rubygem-websocket-driver-0:0.6.5-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | smem-0:1.4-1.el8cf | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | v2v-conversion-host-0:1.14.2-1.el8ev | Fixed | RHBA-2019:4199 |
| CloudForms Management Engine 5.11 | wmi-0:1.3.14-8.el8cf | Fixed | RHBA-2019:4199 |
| Red Hat OpenStack Platform 13.0 (Queens) | jsoncpp-0:1.7.7-1.el7 | Fixed | RHSA-2019:1400 |
| Red Hat OpenStack Platform 13.0 (Queens) | qpid-proton-0:0.27.0-3.el7 | Fixed | RHSA-2019:1400 |
| Red Hat OpenStack Platform 14.0 (Rocky) | qpid-proton-0:0.27.0-3.el7 | Fixed | RHSA-2019:1399 |
| Red Hat OpenStack Platform 14.0 Operational Tools for RHEL 7 | qpid-proton-0:0.27.0-3.el7 | Fixed | RHSA-2019:1398 |
| Red Hat Satellite 6.3 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2779 |
| Red Hat Satellite 6.3 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2779 |
| Red Hat Satellite 6.4 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2778 |
| Red Hat Satellite 6.4 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2778 |
| Red Hat Satellite 6.5 for RHEL 7 | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2777 |
| Red Hat Satellite 6.5 for RHEL 7 | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2777 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Red Hat Virtualization 4.2 for Red Hat Enterprise Linux 7.6 EUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.3 for RHEL 5.9.AUS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 5.ELS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 6 | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 6.4.AUS | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 6.5.AUS | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 6.6.AUS | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 6.7.EUS | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.2.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.2.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.2.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.3.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.3.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.3.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.4.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.4.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.4.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.5.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.6.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.6.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.3 for RHEL 7.6.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2781 |
| Satellite Tools 6.4 for RHEL 5.9.AUS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 5.ELS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 6 | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 6.7.EUS | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7 | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.2.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.2.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.2.TUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.3.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.3.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.3.TUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.4.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.4.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.4.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.4.TUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.5.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.6.AUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.6.E4S | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.6.EUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.4 for RHEL 7.6.TUS | qpid-proton-0:0.16.0-14.el7sat | Fixed | RHSA-2019:2782 |
| Satellite Tools 6.5 for RHEL 5.9.AUS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 5.ELS | qpid-proton-0:0.9-22.el5 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 6 | qpid-proton-0:0.16.0-14.el6sat | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7 | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.2.AUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.2.E4S | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.2.TUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.3.AUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.3.E4S | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.3.TUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.4.AUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.4.E4S | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.4.EUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.4.TUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.5.EUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.6.AUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.6.E4S | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.6.EUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 7.6.TUS | qpid-proton-0:0.28.0-1.el7 | Fixed | RHSA-2019:2780 |
| Satellite Tools 6.5 for RHEL 8 | qpid-proton-0:0.28.0-1.el8 | Fixed | RHSA-2019:2780 |
| A-MQ Interconnect 1 | qpid-proton | Affected | n/a |
| Red Hat AMQ Broker 7 | qpid-proton | Not affected | n/a |
| Red Hat Enterprise MRG 3 | qpid-proton | Will not fix | n/a |
| Red Hat Fuse 7 | proton-j | Not affected | n/a |
| Red Hat JBoss A-MQ 6 | proton-j | Out of support scope | n/a |
| Red Hat JBoss Fuse 6 | proton-j | Out of support scope | n/a |
| Red Hat OpenShift Application Runtimes | proton-j | Affected | n/a |
| Red Hat OpenStack Platform 8 (Liberty) | qpid-proton | Will not fix | n/a |
| Red Hat Update Infrastructure 3 for Cloud Providers | qpid-proton | Will not fix | n/a |
| Red Hat Virtualization 4 | redhat-virtualization-host | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat OpenStack Platform 14 (and its Operational Tools) is impacted by this flaw; other supported versions are not vulnerable. Red Hat Virtualization 4 uses qpid-proton for katello-agent, which always uses client certificate authentication. Red Hat Update Infrastructure 3 is impacted by this flaw, however in its default configuration client certificate authentication is used and qpidd service, which uses qpid-proton, cannot be reach from other machines.
Red Hat mitigation
This attack will not work if client-certificate authentication is in place because anonymous ciphers would not then be available. Another possible mitigation is to disable anonymous ciphers on clients.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AV:N/AC:M/Au:N/C:P/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 6.20% (0.06201) | 93.30th | v5 (v2026.06.15) |
| Jun 15, 2026 | 6.15% (0.06150) | 92.53th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.48% (0.00483) | 63.14th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.21% (0.00214) | 60.36th | v3 (v2023.03.01) |
| Apr 16, 2024 | 0.21% (0.00208) | 58.36th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.13% (0.00132) | 48.03th | v3 (v2023.03.01) |
| Mar 30, 2023 | 0.13% (0.00125) | 45.35th | v3 (v2023.03.01) |
| Mar 14, 2023 | 0.11% (0.00109) | 42.21th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.13% (0.00127) | 45.59th | v3 (v2023.03.01) |
| Mar 6, 2023 | 5.24% (0.05242) | 89.75th | v2 (v2022.01.01) |
| Apr 1, 2022 | 5.24% (0.05242) | 88.72th | v2 (v2022.01.01) |
| Feb 4, 2022 | 35.69% (0.35688) | 96.93th | v2 (v2022.01.01) |
| Feb 3, 2022 | 35.25% (0.35248) | 97.92th | v1 |
| Jan 6, 2022 | 35.25% (0.35248) | 97.89th | v1 |
| Sep 1, 2021 | 10.82% (0.10820) | 95.26th | v1 |
| Apr 14, 2021 | 10.82% (0.10820) | 0.00th | v1 |
References (23)
- http://www.openwall.com/lists/oss-security/2019/04/23/4 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/108044 vdb-entryx_refsource_BIDBroken Link
- https://access.redhat.com/errata/RHSA-2019:0886 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1398 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1399 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1400 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2777 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2778 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2779 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2780 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2781 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2782 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-0223 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1702439 Issue Tracking
- https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel x_refsource_MISCIssue TrackingVendor Advisory
- https://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3E mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2019-0223
- https://qpid.apache.org/cves/CVE-2019-0223.html
- https://www.cve.org/CVERecord?id=CVE-2019-0223
Change history (0)
No recorded changes yet.