Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.8
CVSSv2

CVE-2019-0223

Published: 23/04/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 7.4 | Impact Score: 5.2 | Exploitability Score: 2.2
VMScore: 516
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Subscribe to Apache

Vulnerability Summary

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions prior to 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache qpid

redhat jboss_amq_clients_2 -

redhat enterprise linux desktop 7.0

redhat enterprise linux server aus 7.2

redhat enterprise linux workstation 7.0

redhat enterprise linux server tus 7.2

redhat enterprise linux server 7.0

redhat enterprise linux server aus 6.6

redhat enterprise linux eus 6.7

redhat enterprise linux server aus 6.5

redhat enterprise linux server aus 6.4

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux server tus 7.3

redhat enterprise linux server aus 7.3

redhat enterprise linux server aus 7.4

redhat enterprise linux server tus 7.4

redhat enterprise linux eus 7.3

redhat enterprise linux eus 7.4

redhat enterprise linux eus 7.5

redhat satellite 6.3

redhat enterprise linux server aus 5.9

redhat enterprise linux server tus 7.6

redhat enterprise linux server aus 7.6

redhat enterprise linux eus 7.6

redhat satellite 6.4

redhat enterprise linux eus 7.2

redhat openstack 14

redhat openstack 13

redhat satellite 6.5

Vendor Advisories

Red Hat: Important: AMQ Clients 2.3.1 release and security update
Synopsis Important: AMQ Clients 231 release and security update Type/Severity Security Advisory: Important Topic Updated Red Hat AMQ Clients 231 packages are now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS ...
Red Hat: Moderate: qpid-proton security update
Synopsis Moderate: qpid-proton security update Type/Severity Security Advisory: Moderate Topic An update for qpid-proton is now available for Red Hat OpenStack Platform14 (Rocky)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVS ...
Red Hat: Important: qpid-proton security update
Synopsis Important: qpid-proton security update Type/Severity Security Advisory: Important Topic An update for qpid-proton is now available for Red Hat Satellite 63 for RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVS ...
Red Hat: Important: qpid-proton security update
Synopsis Important: qpid-proton security update Type/Severity Security Advisory: Important Topic An update for qpid-proton is now available for Red Hat Satellite 65 for RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVS ...
Red Hat: Moderate: qpid-proton security update
Synopsis Moderate: qpid-proton security update Type/Severity Security Advisory: Moderate Topic An update for qpid-proton is now available for Red Hat OpenStack Platform 13 (Queens)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (C ...
Red Hat: Moderate: qpid-proton security update
Synopsis Moderate: qpid-proton security update Type/Severity Security Advisory: Moderate Topic An update for qpid-proton is now available for Red Hat OpenStack Platform14 (Rocky)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVS ...
Red Hat: Important: qpid-proton security update
Synopsis Important: qpid-proton security update Type/Severity Security Advisory: Important Topic An update for qpid-proton is now available for Satellite Tools 65Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score ...
Red Hat: Important: qpid-proton security update
Synopsis Important: qpid-proton security update Type/Severity Security Advisory: Important Topic An update for qpid-proton is now available for Red Hat Satellite 64 for RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVS ...
Red Hat: CVE-2019-0223
Impact: Important Public Date: 2019-04-23 CWE: CWE-295->CWE-300 Bugzilla: 1702439: CVE-2019-0223 qpi ...

Github Repositories

https://github.com/hambuergaer/satellite_host_errata_report

Create a Satellite host errata report (csv)

Create a Satellite host errata report (csv) To get a frequently report of installable Red Hat errata on a per host basis you can use this Python script Download it to your Satellite server or any other host where Python 27 is installed Table of Contents Prerequisites 1 Where to get the available API calls 2 Where to find the available JSON fields to query within the Pytho

References

NVD-CWE-noinfohttps://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanelhttp://www.openwall.com/lists/oss-security/2019/04/23/4http://www.securityfocus.com/bid/108044https://access.redhat.com/errata/RHSA-2019:0886https://access.redhat.com/errata/RHSA-2019:1400https://access.redhat.com/errata/RHSA-2019:1399https://access.redhat.com/errata/RHSA-2019:1398https://access.redhat.com/errata/RHSA-2019:2777https://access.redhat.com/errata/RHSA-2019:2778https://access.redhat.com/errata/RHSA-2019:2779https://access.redhat.com/errata/RHSA-2019:2780https://access.redhat.com/errata/RHSA-2019:2781https://access.redhat.com/errata/RHSA-2019:2782https://lists.apache.org/thread.html/49c83f0acce5ceaeffca51714ec2ba0f0199bcb8f99167181bba441b%40%3Cdev.qpid.apache.org%3Ehttps://lists.apache.org/thread.html/3adb2f020f705b4fd453982992a68cd10f9d5ac728b699efdb73c1f5%40%3Cdev.qpid.apache.org%3Ehttps://lists.apache.org/thread.html/d9c9a882a292e2defaed1f954528c916fb64497ce57db652727e39b0%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/008ee5e78e5a090e1fcc5f6617f425e4e51d59f03d3eda2dd006df9f%40%3Cusers.qpid.apache.org%3Ehttps://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3Ehttps://nvd.nist.govhttps://github.com/hambuergaer/satellite_host_errata_reporthttps://access.redhat.com/errata/RHSA-2019:0886https://access.redhat.com/security/cve/cve-2019-0223
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-38028CVE-2024-32406CVE-2024-25624IMAPCVE-2024-2310CVE-2024-0874CVE-2024-20359XXEremote code execution
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook