Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton | 0.9 to 0.27.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qpid-proton | 0.22.0-1 | — |
| Debian 13 | qpid-proton | 0.22.0-1 | — |
| Debian 12 | qpid-proton | 0.22.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | qpid-proton | No fix yet | — |
| Ubuntu 16.04 LTS | qpid-proton | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qpid-proton +2 | 0.16.0-14.el7sat | RHSA-2019:2782, RHSA-2019:2780 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | qpid-proton +2 | 0.16.0-14.el7sat | RHSA-2019:2779, RHSA-2019:2778, RHSA-2019:2777 |
| Red Hat Satellite 6 | qpid-proton +2 | 0.16.0-14.el7sat | RHSA-2019:2779, RHSA-2019:2778, RHSA-2019:2777 |
| Red Hat Rhel Satellite Tools 6 | python3-qpid-proton | 0.28.0-1.el8 | RHSA-2019:2780 |
| Red Hat Rhel Satellite Tools 6 | qpid-proton +2 | 0.9-22.el5 | RHSA-2019:2782, RHSA-2019:2781, RHSA-2019:2780 |
| Red Hat Openstack-optools 14 | qpid-proton +1 | 0.27.0-3.el7 | RHSA-2019:1398 |
| Red Hat OpenStack 14 | qpid-proton +2 | 0.27.0-3.el7 | RHSA-2019:1399 |
| Red Hat OpenStack 13 | jsoncpp | 1.7.7-1.el7 | RHSA-2019:1400 |
| Red Hat OpenStack 13 | qpid-proton +3 | 0.27.0-3.el7 | RHSA-2019:1400 |
| Red Hat CloudForms 5 | ansible-runner +1 | 1.3.4-2.el8ar | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ansible-tower-venv-ansible | 3.5.2-1.el8at | RHBA-2019:4199 |
| Red Hat CloudForms 5 | cfme +5 | 5.11.0.28-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-cluster-upgrade | 1.1.13-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-disaster-recovery | 1.2.0-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-engine-setup | 1.1.9-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-hosted-engine-setup | 1.0.26-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-image-template | 1.1.11-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-infra | 1.1.12-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-manageiq | 1.1.14-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-repositories | 1.1.5-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-roles | 1.1.7-2.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-shutdown-env | 1.0.3-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | ovirt-ansible-vm-infra | 1.1.19-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | prince | 12.4-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-bambou +1 | 3.0.1-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-colorama +1 | 0.4.1-1.el8ost | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-daemon +1 | 2.1.2-9.el8ar | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-funcsigs +1 | 1.0.2-3.el8ost | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-future +1 | 0.16.0-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-lockfile +1 | 1:0.11.0-8.el8ar | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-mock +1 | 2.0.0-11.el8ost | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-pbr +1 | 5.1.2-2.el8ost | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-pexpect +1 | 4.6-2.el8ar | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-psutil +1 | 5.4.3-5.el8ar | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-pylxca +1 | 2.1.1-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-requests-toolbelt +1 | 0.8.0-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-tabulate +1 | 0.8.2-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python-vspk +1 | 5.3.2-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | python3-ovirt-engine-sdk4 | 4.3.2-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | qpid-proton +3 | 0.28.0-1.el8 | RHBA-2019:4199 |
| Red Hat CloudForms 5 | repmgr10 | 4.0.6-3.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-bcrypt +1 | 3.1.13-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-byebug +1 | 11.0.1-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-escape_utils +1 | 1.2.1-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-ffi +1 | 1.9.25-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-hamlit +1 | 2.8.10-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-http_parser.rb +1 | 0.6.0-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-linux_block_device +1 | 0.2.1-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-memory_buffer +1 | 0.1.0-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-nio4r +1 | 2.4.0-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-nokogiri +1 | 1.8.5-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-ovirt-engine-sdk4 +1 | 4.3.0-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-puma +1 | 3.7.1-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-qpid_proton +1 | 0.26.0-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-rugged +1 | 0.28.2-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-sassc +1 | 2.0.1-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-sqlite3 +1 | 1.3.13-2.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-surro-gate +1 | 1.0.5-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-unf_ext +1 | 0.0.7.6-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | rubygem-websocket-driver +1 | 0.6.5-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | smem | 1.4-1.el8cf | RHBA-2019:4199 |
| Red Hat CloudForms 5 | v2v-conversion-host +1 | 1.14.2-1.el8ev | RHBA-2019:4199 |
| Red Hat CloudForms 5 | wmi | 1.3.14-8.el8cf | RHBA-2019:4199 |
| Red Hat A Mq Clients 2 | qpid-proton +9 | 0.27.0-3.el6 | RHSA-2019:0886 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | qpid-proton | 0.38.0-150000.6.3.1 | SUSE-SU-2024:1074-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | qpid-proton | 0.38.0-150000.6.3.1 | SUSE-SU-2024:1074-1 |
Advisories 12
- RHSA-2019:2782 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2780 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2781 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2779 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2778 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2777 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1399 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1400 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1398 Red Hat Security Advisory: qpid-proton security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0886 Red Hat Security Advisory: AMQ Clients 2.3.1 release and security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHBA-2019:4199 Red Hat Bug Fix Advisory: CloudForms 5.0 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- SUSE-SU-2024:1074-1 Security update for qpid-proton SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability mailing-list
- [qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability mailing-list
- [oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability mailing-list
- [announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability mailing-list
- [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability mailing-list
- https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel
- qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223 mailing-list
- 108044 vdb-entry
- RHSA-2019:0886 vendor-advisory
- RHSA-2019:1399 vendor-advisory
- RHSA-2019:1400 vendor-advisory
- RHSA-2019:1398 vendor-advisory
- RHSA-2019:2777 vendor-advisory
- RHSA-2019:2778 vendor-advisory
- RHSA-2019:2779 vendor-advisory
- RHSA-2019:2780 vendor-advisory
- RHSA-2019:2781 vendor-advisory
- RHSA-2019:2782 vendor-advisory