Bug 1651837 (CVE-2018-17187)

Summary:	CVE-2018-17187 qpid-proton-java: Hostname verification mode not implemented in transport TLS wrapper
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, avibelli, bgeorges, chazlett, gmalinko, hghasemb, iboverma, janstey, java-sig-commits, jbalunas, jpallich, jross, jshepherd, krathod, lthon, mcressma, mszynkie, pdelbell, pgallagh, puntogil, rrajasek, rruss, rstepani
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	qpid-proton-j 0.30.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 09:50:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1651838
Bug Blocks:	1651839

Description Sam Fowler 2018-11-21 02:03:29 UTC

The Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed.

The latter hostname verifying mode was not previously implemented, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack.

Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS.


External References:

https://qpid.apache.org/cves/CVE-2018-17187.html
https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E


Upstream Bug:

https://issues.apache.org/jira/browse/PROTON-1962


Upstream Patch:

https://git-wip-us.apache.org/repos/asf?p=qpid-proton-j.git;h=0cb8ca0

Comment 1 Sam Fowler 2018-11-21 02:03:56 UTC

Created qpid-proton-java tracking bugs for this issue:

Affects: fedora-all [bug 1651838]

Comment 2 Doran Moppert 2018-12-11 01:23:59 UTC

Statement:

This flaw is present in qpid-proton-java packages in Red Hat Enterprise MRG Messaging, however the vulnerable TLS transport functionality is not used by any components of MRG Messaging so the vulnerability is not exposed. For MRG Messaging, this vulnerability has been given an impact rating of Low, and is not planned to be fixed at this time.

Comment 3 Joshua Padman 2019-05-15 22:52:50 UTC

This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss A-MQ 6
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.