Skip to content
Fencer Intel
high 7.4

CVE-2019-0223 json

Withdrawn Advisory: Improper Certificate Validation in Apache Qpid Proton

published 7y ago modified last mo. also GHSA-5h6x-m52p-23ph , EUVD-2022-2590

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.2%
EPSS 6.2% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

Patch / fix

  • qpid-proton Debian 14, Debian 13, Debian 12 0.22.0-1

debian advisories DEBIAN-CVE-2019-0223

  • qpid-proton RHEL 6.5 SATELLITE_TOOLS, RHEL 6.4 SATELLITE_TOOLS, RHEL 6.3 SATELLITE_TOOLS 0.9-22.el5
  • qpid-proton RHEL 6.5 SATELLITE_TOOLS, RHEL 6.4 SATELLITE_TOOLS, RHEL 6.3 SATELLITE_TOOLS 0.16.0-14.el6sat
  • qpid-proton satellite capsule 6.5, satellite 6.5, RHEL 7 +1 more 0.28.0-1.el7
  • qpid-proton RHEL 6.5 SATELLITE_TOOLS, cloudforms managementengine 5.11 0.28.0-1.el8
  • qpid-proton-c RHEL 6.5 SATELLITE_TOOLS, RHEL 6.4 SATELLITE_TOOLS, RHEL 6.3 SATELLITE_TOOLS 0.9-22.el5
  • qpid-proton-c RHEL 6.5 SATELLITE_TOOLS, RHEL 6.4 SATELLITE_TOOLS, RHEL 6.3 SATELLITE_TOOLS 0.16.0-14.el6sat
  • qpid-proton-c satellite capsule 6.5, satellite 6.5, RHEL 7 +1 more 0.28.0-1.el7
  • qpid-proton-c RHEL 6.5 SATELLITE_TOOLS 0.28.0-1.el8

red hat advisories RHSA-2019:2780RHSA-2019:2782RHSA-2019:2781RHSA-2019:2779RHSA-2019:2777RHSA-2019:2778

  • qpid-proton SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5 0.38.0-150000.6.3.1

suse advisories SUSE-SU-2024:1074-1

Is CVE-2019-0223 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-0223 updated cvss 7.4

qpid-proton: TLS Man in the Middle Vulnerability

  • Red Hat A-MQ Interconnect 1 qpid-proton
    affected: workaround, no fix available
  • Red Hat Enterprise MRG 3 qpid-proton
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss A-MQ 6 proton-j Red Hat JBoss Fuse 6 proton-j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes proton-j
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 8 (Liberty) qpid-proton-c, python-qpid-proton Red Hat Update Infrastructure 3 for Cloud Providers qpid-proton
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CloudForms Management Engine 5.11 smem 1.4-1.el8cf, wmi 1.3.14-8.el8cf, prince 12.4-1.el8cf, cfme 5.11.0.28-1.el8cf, repmgr10 4.0.6-3.el8cf, qpid-proton 0.28.0-1.el8, +70 more
    fixed: vendor fix RHBA-2019:4199
  • Red Hat AMQ Clients 2 qpid-proton 0.27.0-3.el6, qpid-proton 0.27.0-3.el7, qpid-proton-c 0.27.0-3.el6, qpid-proton-c 0.27.0-3.el7, qpid-proton-cpp 0.27.0-3.el6, qpid-proton-cpp 0.27.0-3.el7, +4 more
    fixed: vendor fix RHSA-2019:0886
  • Red Hat OpenStack Platform 13.0 jsoncpp 1.7.7-1.el7, qpid-proton 0.27.0-3.el7, qpid-proton-c 0.27.0-3.el7, qpid-proton-cpp 0.27.0-3.el7, python-qpid-proton 0.27.0-3.el7
    fixed: vendor fix RHSA-2019:1400
show 11 more
  • Red Hat OpenStack Platform 14.0 qpid-proton 0.27.0-3.el7, qpid-proton-c 0.27.0-3.el7, python-qpid-proton 0.27.0-3.el7
    fixed: vendor fix RHSA-2019:1399
  • Red Hat OpenStack Platform 14.0 Operational Tools for RHEL 7 qpid-proton 0.27.0-3.el7, qpid-proton-c 0.27.0-3.el7
    fixed: vendor fix RHSA-2019:1398
  • Red Hat Satellite 6.3 qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2779
  • Red Hat Satellite 6.4 qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2778
  • Red Hat Satellite 6.5 qpid-proton 0.28.0-1.el7, qpid-proton-c 0.28.0-1.el7, python-qpid-proton 0.28.0-1.el7
    fixed: vendor fix RHSA-2019:2777
  • Red Hat Satellite Capsule 6.3 qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2779
  • Red Hat Satellite Capsule 6.4 qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2778
  • Red Hat Satellite Capsule 6.5 qpid-proton 0.28.0-1.el7, qpid-proton-c 0.28.0-1.el7, python-qpid-proton 0.28.0-1.el7
    fixed: vendor fix RHSA-2019:2777
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts qpid-proton-c 0.28.0-1.el7, qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.28.0-1.el7, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2782
  • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts qpid-proton 0.28.0-1.el7, qpid-proton-c 0.28.0-1.el7, python-qpid-proton 0.28.0-1.el7
    fixed: vendor fix RHSA-2019:2780
  • Red Hat Satellite Tools 6.3 (v. 5.9.AUS Server) qpid-proton 0.9-22.el5, qpid-proton-c 0.9-22.el5, python-qpid-proton 0.9-22.el5 Red Hat Satellite Tools 6.3 (v. 5.9.ELS Server) qpid-proton 0.9-22.el5, qpid-proton-c 0.9-22.el5, python-qpid-proton 0.9-22.el5 Red Hat Satellite Tools 6.3 (v. 6 Client) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6 ComputeNode) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6 Server) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6 Workstation) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat
    +14 more products
    Red Hat Satellite Tools 6.3 (v. 6.4.AUS Server) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6.5.AUS Server) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6.6.AUS Server) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6.7.EUS ComputeNode) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 6.7.EUS Server) qpid-proton 0.16.0-14.el6sat, qpid-proton-c 0.16.0-14.el6sat, python-qpid-proton 0.16.0-14.el6sat Red Hat Satellite Tools 6.3 (v. 7 ComputeNode) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7 Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7 Workstation) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.2.AUS Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.2.E4S Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.2.EUS ComputeNode) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.2.EUS Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.3.AUS Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat Red Hat Satellite Tools 6.3 (v. 7.3.E4S Server) qpid-proton 0.16.0-14.el7sat, qpid-proton-c 0.16.0-14.el7sat, python-qpid-proton 0.16.0-14.el7sat
    fixed: vendor fix RHSA-2019:2781

75 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.23% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • Apache Software Foundation Apache Qpid Proton

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.