Executive brief
Apache Qpid's Python client library failed to properly validate SSL certificate hostnames, allowing an attacker to impersonate a legitimate server using any valid certificate issued to a different domain. Organizations using this client to connect to message brokers or other services over SSL/TLS could be subject to man-in-the-middle attacks where an attacker intercepts connections and reads or modifies sensitive messages without detection.
Technical details
The Python client in Apache Qpid before version 0.22 does not verify that the server hostname matches a domain name in the X.509 certificate's Common Name (CN) or subjectAltName (SAN) fields. This is a classic certificate validation bypass (CWE-20) affecting SSL/TLS connections. The vulnerability is network-accessible with no authentication or user interaction required—an attacker on the network path can present a valid certificate for any domain and the client will accept it. An attacker can perform man-in-the-middle attacks to eavesdrop on or modify AMQP message traffic. The fix was patched in version 0.22 by adding hostname verification logic to the SSL connection validation.
Affected products
- Apache Qpid Python client before 0.22
Timeline
- 2013-08-23: disclosed
- 0.22: patched