-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: AMQ Clients 2.3.1 release and security update
Advisory ID:       RHSA-2019:0886-01
Product:           Red Hat AMQ Clients
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:0886
Issue date:        2019-04-25
CVE Names:         CVE-2019-0223 
====================================================================
1. Summary:

Updated Red Hat AMQ Clients 2.3.1 packages are now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

6Client-AMQ-Clients-2 - i386, noarch, x86_64
6ComputeNode-AMQ-Clients-2 - noarch, x86_64
6Server-AMQ-Clients-2 - i386, noarch, x86_64
6Workstation-AMQ-Clients-2 - i386, noarch, x86_64
7Client-AMQ-Clients-2 - noarch, x86_64
7ComputeNode-AMQ-Clients-2 - noarch, x86_64
7Server-AMQ-Clients-2 - noarch, x86_64
7Workstation-AMQ-Clients-2 - noarch, x86_64

3. Description:

Red Hat AMQ Clients enable connecting, sending, and receiving messages over
the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7.

This update provides various bug fixes and enhancements in addition to the
client package versions previously released on Red Hat Enterprise Linux 6
and 7.

Security Fix(es):

* qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1702439 - CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability

6. JIRA issues fixed (https://issues.redhat.com/):

ENTMQCL-1294 - CVE-2019-0223: qpid-proton: TLS Man in the Middle Vulnerability [amq-cl-2]

7. Package List:

6Client-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el6.src.rpm

i386:
python-qpid-proton-0.27.0-3.el6.i686.rpm
qpid-proton-c-0.27.0-3.el6.i686.rpm
qpid-proton-c-devel-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm
qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-tests-0.27.0-3.el6.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm

6ComputeNode-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el6.src.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-tests-0.27.0-3.el6.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm

6Server-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el6.src.rpm

i386:
python-qpid-proton-0.27.0-3.el6.i686.rpm
qpid-proton-c-0.27.0-3.el6.i686.rpm
qpid-proton-c-devel-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm
qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-tests-0.27.0-3.el6.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm

6Workstation-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el6.src.rpm

i386:
python-qpid-proton-0.27.0-3.el6.i686.rpm
qpid-proton-c-0.27.0-3.el6.i686.rpm
qpid-proton-c-devel-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-0.27.0-3.el6.i686.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm
qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm
qpid-proton-tests-0.27.0-3.el6.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-0.27.0-3.el6.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm

7Client-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el7.src.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-tests-0.27.0-3.el7.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm

7ComputeNode-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el7.src.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-tests-0.27.0-3.el7.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm

7Server-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el7.src.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-tests-0.27.0-3.el7.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm

7Workstation-AMQ-Clients-2:

Source:
qpid-proton-0.27.0-3.el7.src.rpm

noarch:
python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm
qpid-proton-tests-0.27.0-3.el7.noarch.rpm

x86_64:
python-qpid-proton-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-0.27.0-3.el7.x86_64.rpm
qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm
qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm
qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

https://access.redhat.com/security/cve/CVE-2019-0223
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_amq/

9. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXMFmANzjgjWX9erEAQhWOA/7Bqozi6cF2fu9KJ2HrZSeHlBb0d/sqy8p
+/PAWvTokYp0ZuzyBDEPYczX/t1jxnDf0nkSfoM7YUN0sE+2lDqVEamfdhM/At8f
jJTw/yFJcbClBAHgD+BlTVDQns2tVtkCWqai1Q4atVKuGmmqauH78Y7JnNqNXq1F
BPSrb9yyfEpyMgasG/6pH+vL+/k43/EInRVcIKaYhX0XFwvC2l2j06ImdCH0xxrg
XLq3Vs7uB4Gv0R1hRZslw0Y4wF8nziUHYpPJcA+Ogx+ovDFT8YJQ15p2Fqdwf7On
SPPM56kZLa7Xz1DXDETqUmExgnGRqsllHHlIid0hZI2I23qzV6xQ+EolL/yFW9vm
ePGr7Ur9OzdvTWugaFZtOXRug0rPe9U1RAMtJR6v9i8jVju1/7dnxaNWsOEBbOs9
yNxBgXFTEcJXSpuK5GbkMDfnhYlrVzs+jetcnaKgyro2rAOlJzMqNVDBWm4gOLao
3LXycEtvoXZq7q0EehMmZWfjjSADrMddHDQXHm7jCd4JoAoOR+S5QNSQZLUB6Dng
CnlpIE4YJfwEEtJDbi7m36+tKbLT9tJVgPVJpd4Cr1chVjEJcsrNfctN190bxvAT
iBF+dg6U4NXUkclmYjhy8sGWEiJa8c9SfwFtkKrwarPCXVwoyTEQL7fcPCy8+yCY
Yqtn+S6Mr0A=u9Uq
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2019-0886:01 Important: AMQ Clients 2.3.1 release and security

Updated Red Hat AMQ Clients 2.3.1 packages are now available

Summary

Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol to or from AMQ Broker 6 and 7.
This update provides various bug fixes and enhancements in addition to the client package versions previously released on Red Hat Enterprise Linux 6 and 7.
Security Fix(es):
* qpid-proton: TLS Man in the Middle Vulnerability (CVE-2019-0223)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2019-0223 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_amq/

Package List

6Client-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el6.src.rpm
i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm
6ComputeNode-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el6.src.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm
6Server-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el6.src.rpm
i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm
6Workstation-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el6.src.rpm
i386: python-qpid-proton-0.27.0-3.el6.i686.rpm qpid-proton-c-0.27.0-3.el6.i686.rpm qpid-proton-c-devel-0.27.0-3.el6.i686.rpm qpid-proton-cpp-0.27.0-3.el6.i686.rpm qpid-proton-cpp-devel-0.27.0-3.el6.i686.rpm qpid-proton-debuginfo-0.27.0-3.el6.i686.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el6.noarch.rpm qpid-proton-c-docs-0.27.0-3.el6.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el6.noarch.rpm qpid-proton-tests-0.27.0-3.el6.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el6.x86_64.rpm qpid-proton-c-0.27.0-3.el6.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-0.27.0-3.el6.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el6.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el6.x86_64.rpm
7Client-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el7.src.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm
7ComputeNode-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el7.src.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm
7Server-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el7.src.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm
7Workstation-AMQ-Clients-2:
Source: qpid-proton-0.27.0-3.el7.src.rpm
noarch: python-qpid-proton-docs-0.27.0-3.el7.noarch.rpm qpid-proton-c-docs-0.27.0-3.el7.noarch.rpm qpid-proton-cpp-docs-0.27.0-3.el7.noarch.rpm qpid-proton-tests-0.27.0-3.el7.noarch.rpm
x86_64: python-qpid-proton-0.27.0-3.el7.x86_64.rpm qpid-proton-c-0.27.0-3.el7.x86_64.rpm qpid-proton-c-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-0.27.0-3.el7.x86_64.rpm qpid-proton-cpp-devel-0.27.0-3.el7.x86_64.rpm qpid-proton-debuginfo-0.27.0-3.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2019:0886-01
Product: Red Hat AMQ Clients
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0886
Issued Date: : 2019-04-25
CVE Names: CVE-2019-0223

Topic

Updated Red Hat AMQ Clients 2.3.1 packages are now available.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

6Client-AMQ-Clients-2 - i386, noarch, x86_64

6ComputeNode-AMQ-Clients-2 - noarch, x86_64

6Server-AMQ-Clients-2 - i386, noarch, x86_64

6Workstation-AMQ-Clients-2 - i386, noarch, x86_64

7Client-AMQ-Clients-2 - noarch, x86_64

7ComputeNode-AMQ-Clients-2 - noarch, x86_64

7Server-AMQ-Clients-2 - noarch, x86_64

7Workstation-AMQ-Clients-2 - noarch, x86_64


Bugs Fixed

1702439 - CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability

6. JIRA issues fixed (https://issues.redhat.com/):

ENTMQCL-1294 - CVE-2019-0223: qpid-proton: TLS Man in the Middle Vulnerability [amq-cl-2]


Related News