https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:13:39 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-02465 bdu:2019-02465 https://cve.radiocsirt.org/vuln/bdu:2019-02465 https://cve.radiocsirt.org/vuln/euvd-2026-48394 EUVD-2026-48394 https://cve.radiocsirt.org/vuln/euvd-2026-48394 https://cve.radiocsirt.org/vuln/fkie_cve-2019-0223 <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-0223 https://cve.radiocsirt.org/vuln/ghsa-5h6x-m52p-23ph <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Maven: org.apache.qpid:proton-j</p> <p>## Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the **Qpid Proton C library** and not `org.apache.qpid:proton-j`. This link has been maintained to preserve external references.</p> <p>## Original Description</p> <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Maven: org.apache.qpid:proton-j</p> <p>## Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the **Qpid Proton C library** and not `org.apache.qpid:proton-j`. This link has been maintained to preserve external references.</p> <p>## Original Description</p> <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> https://cve.radiocsirt.org/vuln/ghsa-5h6x-m52p-23ph https://cve.radiocsirt.org/vuln/gsd-2019-0223 gsd-2019-0223 https://cve.radiocsirt.org/vuln/gsd-2019-0223 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13808-1 <p>libqpid-proton-core10-0.38.0-2.1 on GA media</p> <p>libqpid-proton-core10-0.38.0-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13808-1 https://cve.radiocsirt.org/vuln/rhba-2019:4199 <p>bootstrap: XSS in the data-target attribute qpid-proton: TLS Man in the Middle Vulnerability</p> <p>bootstrap: XSS in the data-target attribute qpid-proton: TLS Man in the Middle Vulnerability</p> https://cve.radiocsirt.org/vuln/rhba-2019:4199 https://cve.radiocsirt.org/vuln/suse-su-2024:1074-1 <p>Security update for qpid-proton</p> <p>Security update for qpid-proton</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1074-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-0223 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: qpid-proton, Ubuntu:18.04:LTS: qpid-proton</p> <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: qpid-proton, Ubuntu:18.04:LTS: qpid-proton</p> <p>While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-0223