CVE-2013-1909
Fixed in a distro release EPSS 2%
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Products: redhat enterprise_mrg, apache qpid
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | qpid-python | 0.22 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat enterprise mrg 2 computenode el6 | python-qpid | 0:0.18-5.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | python-qpid-qmf | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-client | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-client-ssl | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-debuginfo | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-server | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-cpp-server-ssl | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-qmf | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-qmf-debuginfo | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | qpid-tools | 0:0.18-10.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | ruby-qpid-qmf | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 server el6 | python-qpid | 0:0.18-5.el6_4 |
| Red Hat enterprise mrg 2 server el6 | python-qpid-qmf | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-devel | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-devel-docs | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-rdma | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-client-ssl | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-debuginfo | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-cluster | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-devel | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-rdma | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-ssl | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-store | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-cpp-server-xml | 0:0.18-17.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-java | 0:0.18-8.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-client | 0:0.18-8.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-common | 0:0.18-8.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-java-example | 0:0.18-8.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf-debuginfo | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-qmf-devel | 0:0.18-18.el6_4 |
| Red Hat enterprise mrg 2 server el6 | qpid-tools | 0:0.18-10.el6_4 |
| Red Hat enterprise mrg 2 server el6 | ruby-qpid-qmf | 0:0.18-18.el6_4 |