The Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not previously implemented, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. External References: https://qpid.apache.org/cves/CVE-2018-17187.html https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFitrpQSV73Vz7rJYfLJK7gvEymZSCR5ooWUeU8j4jzRydk-eg%40mail.gmail.com%3E Upstream Bug: https://issues.apache.org/jira/browse/PROTON-1962 Upstream Patch: https://git-wip-us.apache.org/repos/asf?p=qpid-proton-j.git;h=0cb8ca0
Created qpid-proton-java tracking bugs for this issue: Affects: fedora-all [bug 1651838]
Statement: This flaw is present in qpid-proton-java packages in Red Hat Enterprise MRG Messaging, however the vulnerable TLS transport functionality is not used by any components of MRG Messaging so the vulnerability is not exposed. For MRG Messaging, this vulnerability has been given an impact rating of Low, and is not planned to be fixed at this time.
This vulnerability is out of security support scope for the following products: * Red Hat JBoss A-MQ 6 * Red Hat JBoss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.