While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton     versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS
    *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This     means that an undetected man in the middle attack could be constructed if an attacker can arrange to     intercept TLS traffic. (CVE-2019-0223)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton
    versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS
    *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This
    means that an undetected man in the middle attack could be constructed if an attacker can arrange to
    intercept TLS traffic. (CVE-2019-0223)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0886 advisory.

    Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport     protocol to or from AMQ Broker 6 and 7.

    This update provides various bug fixes and enhancements in addition to the client package versions     previously released on Red Hat Enterprise Linux 6 and 7.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1399 advisory.

    The AMQ Client enables connecting, sending, and receiving messages over the     AMQP 1.0 wire transport protocol.

    This update provides various bug fixes and enhancements in addition to the     client package versions previously released on Red Hat Enterprise Linux 7.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:1398 advisory.

    The AMQ Client enables connecting, sending, and receiving messages over the     AMQP 1.0 wire transport protocol.

    This update provides various bug fixes and enhancements in addition to the     client package versions previously released on Red Hat Enterprise Linux 7.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1400 advisory.

    The AMQ Client enables connecting, sending, and receiving messages over the     AMQP 1.0 wire transport protocol.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This update provides various bug fixes and enhancements in addition to the     client package versions previously released on Red Hat Enterprise Linux 7.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:1074-1 advisory.

    - CVE-2019-0223: Fixed TLS Man in the Middle Vulnerability (bsc#1133158).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2782 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2781 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 / 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2780 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2779 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2778 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2777 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251668	Linux Distros Unpatched Vulnerability : CVE-2019-0223	Nessus	Misc.	high
410846	SCA: security update for org.apache.qpid:proton-j (GHSA-5h6x-m52p-23ph)	Tenable Cloud Security	SCA Checks	high
410846	SCA: security update for org.apache.qpid:proton-j (GHSA-5h6x-m52p-23ph)	Tenable Self-Hosted Container Security	SCA Checks	high
210274	RHEL 6 / 7 : AMQ Clients 2.3.1 (RHSA-2019:0886)	Nessus	Red Hat Local Security Checks	high
194151	RHEL 7 : qpid-proton (RHSA-2019:1399)	Nessus	Red Hat Local Security Checks	high
194149	RHEL 7 : qpid-proton (RHSA-2019:1398)	Nessus	Red Hat Local Security Checks	high
194097	RHEL 7 : qpid-proton (RHSA-2019:1400)	Nessus	Red Hat Local Security Checks	high
192751	openSUSE 15: python3-python-qpid-proton / qpid-proton-devel / etc (SUSE-SU-2024:1074-1)	Nessus	SuSE Local Security Checks	high
129143	RHEL 5 / 6 / 7 : qpid-proton (RHSA-2019:2782)	Nessus	Red Hat Local Security Checks	high
129142	RHEL 5 / 6 / 7 : qpid-proton (RHSA-2019:2781)	Nessus	Red Hat Local Security Checks	high
128985	RHEL 5 / 6 / 7 / 8 : qpid-proton (RHSA-2019:2780)	Nessus	Red Hat Local Security Checks	high
128984	RHEL 7 : qpid-proton (RHSA-2019:2779)	Nessus	Red Hat Local Security Checks	high
128983	RHEL 7 : qpid-proton (RHSA-2019:2778)	Nessus	Red Hat Local Security Checks	high
128982	RHEL 7 : qpid-proton (RHSA-2019:2777)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-0223

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high