Bug 1651837 (CVE-2018-17187)

Summary: CVE-2018-17187 qpid-proton-java: Hostname verification mode not implemented in transport TLS wrapper
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, avibelli, bgeorges, chazlett, hghasemb, iboverma, java-sig-commits, jbalunas, jpallich, jross, jshepherd, krathod, lthon, mcressma, mszynkie, pgallagh, puntogil, rrajasek, rruss
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: qpid-proton-j 0.30.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-25 09:50:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1651838    
Bug Blocks: 1651839    

Description Sam Fowler 2018-11-21 02:03:29 UTC 
The Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed.

The latter hostname verifying mode was not previously implemented, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack.

Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS.


External References:

https://qpid.apache.org/cves/CVE-2018-17187.html
https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E


Upstream Bug:

https://issues.apache.org/jira/browse/PROTON-1962


Upstream Patch:

https://git-wip-us.apache.org/repos/asf?p=qpid-proton-j.git;h=0cb8ca0
Comment 1 Sam Fowler 2018-11-21 02:03:56 UTC 
Created qpid-proton-java tracking bugs for this issue:

Affects: fedora-all [bug 1651838]
Comment 2 Doran Moppert 2018-12-11 01:23:59 UTC 
Statement:

This flaw is present in qpid-proton-java packages in Red Hat Enterprise MRG Messaging, however the vulnerable TLS transport functionality is not used by any components of MRG Messaging so the vulnerability is not exposed. For MRG Messaging, this vulnerability has been given an impact rating of Low, and is not planned to be fixed at this time.
Comment 3 Joshua Padman 2019-05-15 22:52:50 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss A-MQ 6
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.