Description
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | python-qpid | 0.18-5.el6_4 | RHSA-2013:1024 |
| Red Hat MRG 2 | qpid-cpp +12 | 0.18-17.el6_4 | RHSA-2013:1024 |
| Red Hat MRG 2 | qpid-java +3 | 0.18-8.el6_4 | RHSA-2013:1024 |
| Red Hat MRG 2 | qpid-qmf +3 | 0.18-18.el6_4 | RHSA-2013:1024 |
| Red Hat MRG 2 | qpid-tools | 0.18-10.el6_4 | RHSA-2013:1024 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | qpid-python | < 0.22 | 0.22 | GHSA-3g2p-7c6p-vj8c |
Advisories 1
- RHSA-2013:1024 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3.3 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 53968 third-party-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1460013
- https://issues.apache.org/jira/browse/QPID-4918
- RHSA-2013:1024 vendor-advisory
- http://qpid.apache.org/releases/qpid-0.22/release-notes.html
- 54137 third-party-advisory