CVE-2016-4467

MEDIUM

Apache Qpid Proton - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91788
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/07/15/3
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036316

Scores

CVSS v3 5.9
EPSS 0.0041
EPSS Percentile 61.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-295
Status published
Products (10)
apache/qpid_proton 0.8.0
apache/qpid_proton 0.9.0
apache/qpid_proton 0.9.1
apache/qpid_proton 0.10.0
apache/qpid_proton 0.11.0
apache/qpid_proton 0.11.1
apache/qpid_proton 0.12.0
apache/qpid_proton 0.12.1
apache/qpid_proton 0.12.2
apache/qpid_proton 0.13.0
Published May 02, 2017
Tracked Since Feb 18, 2026