CVE-2013-1909

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Score

CVSS 2.0 5.8 Medium

Status

Modified - secalert@redhat.com

Published

2013-08-23

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Qpid (Apache)
• Enterprise Mrg (Redhat)

References

• http://qpid.apache.org/releases/qpid-0.22/release-notes.html
• http://rhn.redhat.com/errata/RHSA-2013-1024.html
• http://secunia.com/advisories/53968
• http://secunia.com/advisories/54137
• http://svn.apache.org/viewvc?view=revision&revision=1460013
• https://issues.apache.org/jira/browse/QPID-4918