| Package | Affected versions | Patched versions |
|---|---|---|
| qpid-python | < 0.22 | 0.22 |
| qpid | = 0.10= 0.11= 0.12= 0.13= 0.14= 0.15= 0.16= 0.17= 0.18= 0.19= 0.5= 0.6= 0.7= 0.8= 0.9≤ 0.20 |
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free