Main-in-the-Middle (MitM)

2019-01-1508:55:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

31.4%

JSON

qpid is vulnerable to man-in-the-middle (MitM) attacks. The vulnerability exists as the Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CPENameOperatorVersion
python-qpideq0.12__1.el6
python-qpideq0.10__1.el6
python-qpideq0.18__4.el6
python-qpideq0.14__11.el6_3
python-qpideq0.14__8.el6
python-qpideq0.7.946106__12.el6
python-qpideq0.14__7.el6_2
qpid-toolseq0.14__6.el6_3
qpid-toolseq0.14__2.el6_2
qpid-toolseq0.7.946106__4.el6

Name	Operator	Version
python-qpid	eq	0.12__1.el6
python-qpid	eq	0.10__1.el6
python-qpid	eq	0.18__4.el6
python-qpid	eq	0.14__11.el6_3
python-qpid	eq	0.14__8.el6
python-qpid	eq	0.7.946106__12.el6
python-qpid	eq	0.14__7.el6_2
qpid-tools	eq	0.14__6.el6_3
qpid-tools	eq	0.14__2.el6_2
qpid-tools	eq	0.7.946106__4.el6