This is an automated email from the ASF dual-hosted git repository.
astitcher pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/qpid-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new e91fd43a0 Add Qpid Proton C CVE advisories
e91fd43a0 is described below
commit e91fd43a0c445aa25f41bbe150d25bf3825eb597
Author: Andrew Stitcher <[email protected]>
AuthorDate: Wed Oct 28 16:11:11 2026 -0400
Add Qpid Proton C CVE advisories
---
.../security.html => cves/CVE-2026-105031.html} | 76 ++++++++++-----------
.../security.html => cves/CVE-2026-105042.html} | 77 ++++++++++------------
.../security.html => cves/CVE-2026-114230.html} | 70 ++++++++------------
.../security.html => cves/CVE-2026-115942.html} | 76 ++++++++++-----------
content/proton/security.html | 28 ++++++++
input/cves/CVE-2026-105031.md | 33 ++++++++++
input/cves/CVE-2026-105042.md | 32 +++++++++
input/cves/CVE-2026-114230.md | 27 ++++++++
input/cves/CVE-2026-115942.md | 34 ++++++++++
input/proton/security.md | 4 ++
10 files changed, 293 insertions(+), 164 deletions(-)
diff --git a/content/proton/security.html b/content/cves/CVE-2026-105031.html
similarity index 82%
copy from content/proton/security.html
copy to content/cves/CVE-2026-105031.html
index 54fa61325..d6e272f04 100644
--- a/content/proton/security.html
+++ b/content/cves/CVE-2026-105031.html
@@ -22,7 +22,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en">
<head>
<meta charset="UTF-8">
- <title>Security - Apache Qpid™</title>
+ <title>CVE-2026-105031 - Apache Qpid™</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
@@ -112,48 +112,42 @@
https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</div>
<div id="-middle" class="panel">
- <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li><a href="/proton/index.html">Qpid
Proton</a></li><li>Security</li></ul>
+ <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li>CVE-2026-105031</li></ul>
<div id="-middle-content">
- <h1 id="security">Security</h1>
-
-<table>
-<thead>
-<tr>
- <th>CVE-ID</th>
- <th>Severity</th>
- <th>Affected versions</th>
- <th>Fixed versions</th>
- <th>Summary</th>
-</tr>
-</thead>
-<tbody>
-<tr>
- <td><a href="/cves/CVE-2016-4467.html">CVE-2016-4467</a></td>
- <td>Medium</td>
- <td>0.8 through 0.13.0 inclusive</td>
- <td>0.13.1 and later</td>
- <td>Failure to verify that the server host name matches the certificate host
name on Windows</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2016-2166.html">CVE-2016-2166</a></td>
- <td>Moderate</td>
- <td>0.9 through 0.12.0 inclusive</td>
- <td>0.12.1 and later</td>
- <td>Python bindings silently ignore request for amqps if SSL/TLS not
supported</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2019-0223.html">CVE-2019-0223</a></td>
- <td>Important</td>
- <td>0.9 through 0.27.0 inclusive</td>
- <td>0.27.1 and later</td>
- <td>TLS Man in the Middle Vulnerability</td>
-</tr>
-</tbody>
-</table>
-
-<p>See the main <a href="/security.html">Security</a> page for general
-information and details for other components.</p>
+ <h1 id="cve-2026-105031">CVE-2026-105031</h1>
+
+<p>The OpenSSL TLS implementation adds a locally trusted certificate authority
to the existing trusted system trust anchors.</p>
+
+<h2 id="severity">Severity</h2>
+
+<p>Important</p>
+
+<h2 id="affected-components">Affected components</h2>
+
+<p>Apache Qpid Proton C</p>
+
+<h2 id="affected-versions">Affected versions</h2>
+
+<p>versions through 0.40.0</p>
+
+<h2 id="fixed-versions">Fixed versions</h2>
+
+<p>0.41.1 and later</p>
+
+<h2 id="description">Description</h2>
+
+<p>When using the OpenSSL TLS implementation, both the
pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs
added to rather than replaced the default system trust anchors. Leading to
potentially trusting unexpected peer certificates.</p>
+
+<p>This issue does not affect the Windows SChannel TLS implementation.</p>
+
+<h2 id="resolution">Resolution</h2>
+
+<p>Users are recommended to upgrade to version 0.41.1, which fixes the
issue.</p>
+
+<h2 id="mitigation">Mitigation</h2>
+
+<p>This can be worked around by setting the SSL_CERT_FILE environment variable
for the application to /dev/null.</p>
<hr/>
diff --git a/content/proton/security.html b/content/cves/CVE-2026-105042.html
similarity index 82%
copy from content/proton/security.html
copy to content/cves/CVE-2026-105042.html
index 54fa61325..0d509e54c 100644
--- a/content/proton/security.html
+++ b/content/cves/CVE-2026-105042.html
@@ -22,7 +22,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en">
<head>
<meta charset="UTF-8">
- <title>Security - Apache Qpid™</title>
+ <title>CVE-2026-105042 - Apache Qpid™</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
@@ -112,48 +112,43 @@
https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</div>
<div id="-middle" class="panel">
- <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li><a href="/proton/index.html">Qpid
Proton</a></li><li>Security</li></ul>
+ <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li>CVE-2026-105042</li></ul>
<div id="-middle-content">
- <h1 id="security">Security</h1>
-
-<table>
-<thead>
-<tr>
- <th>CVE-ID</th>
- <th>Severity</th>
- <th>Affected versions</th>
- <th>Fixed versions</th>
- <th>Summary</th>
-</tr>
-</thead>
-<tbody>
-<tr>
- <td><a href="/cves/CVE-2016-4467.html">CVE-2016-4467</a></td>
- <td>Medium</td>
- <td>0.8 through 0.13.0 inclusive</td>
- <td>0.13.1 and later</td>
- <td>Failure to verify that the server host name matches the certificate host
name on Windows</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2016-2166.html">CVE-2016-2166</a></td>
- <td>Moderate</td>
- <td>0.9 through 0.12.0 inclusive</td>
- <td>0.12.1 and later</td>
- <td>Python bindings silently ignore request for amqps if SSL/TLS not
supported</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2019-0223.html">CVE-2019-0223</a></td>
- <td>Important</td>
- <td>0.9 through 0.27.0 inclusive</td>
- <td>0.27.1 and later</td>
- <td>TLS Man in the Middle Vulnerability</td>
-</tr>
-</tbody>
-</table>
-
-<p>See the main <a href="/security.html">Security</a> page for general
-information and details for other components.</p>
+ <h1 id="cve-2026-105042">CVE-2026-105042</h1>
+
+<p>Unbounded recursion in parsing AMQP message bodies can lead to crash</p>
+
+<h2 id="severity">Severity</h2>
+
+<p>Important</p>
+
+<h2 id="affected-components">Affected components</h2>
+
+<p>Apache Qpid Proton C</p>
+
+<h2 id="affected-versions">Affected versions</h2>
+
+<p>versions through 0.40.0</p>
+
+<h2 id="fixed-versions">Fixed versions</h2>
+
+<p>0.41.1 and later</p>
+
+<h2 id="description">Description</h2>
+
+<p>A message body that is deeply nested and decoded by pn_message_body() could
overflow the stack and cause a crash.</p>
+
+<h2 id="resolution">Resolution</h2>
+
+<p>Users are recommended to upgrade to version 0.41.1, which fixes the
issue.</p>
+
+<h2 id="credit">Credit</h2>
+
+<ul>
+<li>zhangph</li>
+<li>Gjoko Krstic</li>
+</ul>
<hr/>
diff --git a/content/proton/security.html b/content/cves/CVE-2026-114230.html
similarity index 82%
copy from content/proton/security.html
copy to content/cves/CVE-2026-114230.html
index 54fa61325..87299ae04 100644
--- a/content/proton/security.html
+++ b/content/cves/CVE-2026-114230.html
@@ -22,7 +22,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en">
<head>
<meta charset="UTF-8">
- <title>Security - Apache Qpid™</title>
+ <title>CVE-2026-114230 - Apache Qpid™</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
@@ -112,48 +112,36 @@
https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</div>
<div id="-middle" class="panel">
- <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li><a href="/proton/index.html">Qpid
Proton</a></li><li>Security</li></ul>
+ <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li>CVE-2026-114230</li></ul>
<div id="-middle-content">
- <h1 id="security">Security</h1>
-
-<table>
-<thead>
-<tr>
- <th>CVE-ID</th>
- <th>Severity</th>
- <th>Affected versions</th>
- <th>Fixed versions</th>
- <th>Summary</th>
-</tr>
-</thead>
-<tbody>
-<tr>
- <td><a href="/cves/CVE-2016-4467.html">CVE-2016-4467</a></td>
- <td>Medium</td>
- <td>0.8 through 0.13.0 inclusive</td>
- <td>0.13.1 and later</td>
- <td>Failure to verify that the server host name matches the certificate host
name on Windows</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2016-2166.html">CVE-2016-2166</a></td>
- <td>Moderate</td>
- <td>0.9 through 0.12.0 inclusive</td>
- <td>0.12.1 and later</td>
- <td>Python bindings silently ignore request for amqps if SSL/TLS not
supported</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2019-0223.html">CVE-2019-0223</a></td>
- <td>Important</td>
- <td>0.9 through 0.27.0 inclusive</td>
- <td>0.27.1 and later</td>
- <td>TLS Man in the Middle Vulnerability</td>
-</tr>
-</tbody>
-</table>
-
-<p>See the main <a href="/security.html">Security</a> page for general
-information and details for other components.</p>
+ <h1 id="cve-2026-114230">CVE-2026-114230</h1>
+
+<p>Potential authentication bypass: regular AMQP frames can be sent as SASL
frames</p>
+
+<h2 id="severity">Severity</h2>
+
+<p>Important</p>
+
+<h2 id="affected-components">Affected components</h2>
+
+<p>Apache Qpid Proton C</p>
+
+<h2 id="affected-versions">Affected versions</h2>
+
+<p>versions through 0.40.0</p>
+
+<h2 id="fixed-versions">Fixed versions</h2>
+
+<p>0.41.1 and later</p>
+
+<h2 id="description">Description</h2>
+
+<p>When dispatching SASL frames to authenticate the peer, Proton will also
dispatch AMQP frames if they claim to be SASL frames. This allows
authentication bypass. However there will be no user name set so the effects
depend on how the application deals with this condition - which otherwise means
that authentication has not completed yet.</p>
+
+<h2 id="resolution">Resolution</h2>
+
+<p>Users are recommended to upgrade to version 0.41.1, which fixes the
issue.</p>
<hr/>
diff --git a/content/proton/security.html b/content/cves/CVE-2026-115942.html
similarity index 82%
copy from content/proton/security.html
copy to content/cves/CVE-2026-115942.html
index 54fa61325..e9c4b62d3 100644
--- a/content/proton/security.html
+++ b/content/cves/CVE-2026-115942.html
@@ -22,7 +22,7 @@
<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en">
<head>
<meta charset="UTF-8">
- <title>Security - Apache Qpid™</title>
+ <title>CVE-2026-115942 - Apache Qpid™</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<link rel="stylesheet" href="/site.css" type="text/css" async="async"/>
@@ -112,48 +112,42 @@
https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
</div>
<div id="-middle" class="panel">
- <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li><a href="/proton/index.html">Qpid
Proton</a></li><li>Security</li></ul>
+ <ul id="-path-navigation"><li><a
href="/index.html">Home</a></li><li>CVE-2026-115942</li></ul>
<div id="-middle-content">
- <h1 id="security">Security</h1>
-
-<table>
-<thead>
-<tr>
- <th>CVE-ID</th>
- <th>Severity</th>
- <th>Affected versions</th>
- <th>Fixed versions</th>
- <th>Summary</th>
-</tr>
-</thead>
-<tbody>
-<tr>
- <td><a href="/cves/CVE-2016-4467.html">CVE-2016-4467</a></td>
- <td>Medium</td>
- <td>0.8 through 0.13.0 inclusive</td>
- <td>0.13.1 and later</td>
- <td>Failure to verify that the server host name matches the certificate host
name on Windows</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2016-2166.html">CVE-2016-2166</a></td>
- <td>Moderate</td>
- <td>0.9 through 0.12.0 inclusive</td>
- <td>0.12.1 and later</td>
- <td>Python bindings silently ignore request for amqps if SSL/TLS not
supported</td>
-</tr>
-<tr>
- <td><a href="/cves/CVE-2019-0223.html">CVE-2019-0223</a></td>
- <td>Important</td>
- <td>0.9 through 0.27.0 inclusive</td>
- <td>0.27.1 and later</td>
- <td>TLS Man in the Middle Vulnerability</td>
-</tr>
-</tbody>
-</table>
-
-<p>See the main <a href="/security.html">Security</a> page for general
-information and details for other components.</p>
+ <h1 id="cve-2026-115942">CVE-2026-115942</h1>
+
+<p>Verifying non compliant TLS wildcard cert can cause stack buffer overflow
read</p>
+
+<h2 id="severity">Severity</h2>
+
+<p>Low</p>
+
+<h2 id="affected-components">Affected components</h2>
+
+<p>Apache Qpid Proton C</p>
+
+<h2 id="affected-versions">Affected versions</h2>
+
+<p>versions through 0.40.0</p>
+
+<h2 id="fixed-versions">Fixed versions</h2>
+
+<p>0.41.1 and later</p>
+
+<h2 id="description">Description</h2>
+
+<p>A misconfigured wildcard TLS certificate causes a stack read overflow.</p>
+
+<p>This issue does not affect any wildcard certificate issued to the RFC9525
standard - the fix only accepts certificates that comply to this standard.</p>
+
+<h2 id="resolution">Resolution</h2>
+
+<p>Users are recommended to upgrade to version 0.41.1, which fixes the
issue.</p>
+
+<h2 id="credit">Credit</h2>
+
+<p>zhangph</p>
<hr/>
diff --git a/content/proton/security.html b/content/proton/security.html
index 54fa61325..392176021 100644
--- a/content/proton/security.html
+++ b/content/proton/security.html
@@ -149,6 +149,34 @@
https://github.com/apache/qpid-proton/blob/go1{/dir}/{file}#L{line}"/>
<td>0.27.1 and later</td>
<td>TLS Man in the Middle Vulnerability</td>
</tr>
+<tr>
+ <td><a href="/cves/CVE-2026-105031.html">CVE-2026-105031</a></td>
+ <td>Important</td>
+ <td>versions through 0.40.0 inclusive</td>
+ <td>0.41.1 and later</td>
+ <td>TLS implementation adds to the existing trusted system trust anchors</td>
+</tr>
+<tr>
+ <td><a href="/cves/CVE-2026-105042.html">CVE-2026-105042</a></td>
+ <td>Important</td>
+ <td>versions through 0.40.0 inclusive</td>
+ <td>0.41.1 and later</td>
+ <td>Unbounded recursion in parsing AMQP message bodies can lead to crash</td>
+</tr>
+<tr>
+ <td><a href="/cves/CVE-2026-114230.html">CVE-2026-114230</a></td>
+ <td>Important</td>
+ <td>versions through 0.40.0 inclusive</td>
+ <td>0.41.1 and later</td>
+ <td>Regular AMQP frames can be sent as SASL frame</td>
+</tr>
+<tr>
+ <td><a href="/cves/CVE-2026-115942.html">CVE-2026-115942</a></td>
+ <td>Low</td>
+ <td>versions through 0.40.0 inclusive</td>
+ <td>0.41.1 and later</td>
+ <td>Verifying non-compliant TLS wildcard cert can cause stack buffer
overflow read</td>
+</tr>
</tbody>
</table>
diff --git a/input/cves/CVE-2026-105031.md b/input/cves/CVE-2026-105031.md
new file mode 100644
index 000000000..567e60fd8
--- /dev/null
+++ b/input/cves/CVE-2026-105031.md
@@ -0,0 +1,33 @@
+# CVE-2026-105031
+
+The OpenSSL TLS implementation adds a locally trusted certificate authority to
the existing trusted system trust anchors.
+
+## Severity
+
+Important
+
+## Affected components
+
+Apache Qpid Proton C
+
+## Affected versions
+
+versions through 0.40.0
+
+## Fixed versions
+
+0.41.1 and later
+
+## Description
+
+When using the OpenSSL TLS implementation, both the
pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs
added to rather than replaced the default system trust anchors. Leading to
potentially trusting unexpected peer certificates.
+
+This issue does not affect the Windows SChannel TLS implementation.
+
+## Resolution
+
+Users are recommended to upgrade to version 0.41.1, which fixes the issue.
+
+## Mitigation
+
+This can be worked around by setting the SSL_CERT_FILE environment variable
for the application to /dev/null.
diff --git a/input/cves/CVE-2026-105042.md b/input/cves/CVE-2026-105042.md
new file mode 100644
index 000000000..a4cb13d45
--- /dev/null
+++ b/input/cves/CVE-2026-105042.md
@@ -0,0 +1,32 @@
+# CVE-2026-105042
+
+Unbounded recursion in parsing AMQP message bodies can lead to crash
+
+## Severity
+
+Important
+
+## Affected components
+
+Apache Qpid Proton C
+
+## Affected versions
+
+versions through 0.40.0
+
+## Fixed versions
+
+0.41.1 and later
+
+## Description
+
+A message body that is deeply nested and decoded by pn_message_body() could
overflow the stack and cause a crash.
+
+## Resolution
+
+Users are recommended to upgrade to version 0.41.1, which fixes the issue.
+
+## Credit
+
+- zhangph
+- Gjoko Krstic
diff --git a/input/cves/CVE-2026-114230.md b/input/cves/CVE-2026-114230.md
new file mode 100644
index 000000000..593e4c69d
--- /dev/null
+++ b/input/cves/CVE-2026-114230.md
@@ -0,0 +1,27 @@
+# CVE-2026-114230
+
+Potential authentication bypass: regular AMQP frames can be sent as SASL frames
+
+## Severity
+
+Important
+
+## Affected components
+
+Apache Qpid Proton C
+
+## Affected versions
+
+versions through 0.40.0
+
+## Fixed versions
+
+0.41.1 and later
+
+## Description
+
+When dispatching SASL frames to authenticate the peer, Proton will also
dispatch AMQP frames if they claim to be SASL frames. This allows
authentication bypass. However there will be no user name set so the effects
depend on how the application deals with this condition - which otherwise means
that authentication has not completed yet.
+
+## Resolution
+
+Users are recommended to upgrade to version 0.41.1, which fixes the issue.
diff --git a/input/cves/CVE-2026-115942.md b/input/cves/CVE-2026-115942.md
new file mode 100644
index 000000000..0ea5314fd
--- /dev/null
+++ b/input/cves/CVE-2026-115942.md
@@ -0,0 +1,34 @@
+# CVE-2026-115942
+
+Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
+
+## Severity
+
+Low
+
+## Affected components
+
+Apache Qpid Proton C
+
+## Affected versions
+
+versions through 0.40.0
+
+## Fixed versions
+
+0.41.1 and later
+
+## Description
+
+A misconfigured wildcard TLS certificate causes a stack read overflow.
+
+This issue does not affect any wildcard certificate issued to the RFC9525
standard - the fix only accepts certificates that comply to this standard.
+
+## Resolution
+
+Users are recommended to upgrade to version 0.41.1, which fixes the issue.
+
+## Credit
+
+zhangph
+
diff --git a/input/proton/security.md b/input/proton/security.md
index 052d3f974..549dba2fb 100644
--- a/input/proton/security.md
+++ b/input/proton/security.md
@@ -24,6 +24,10 @@
| [CVE-2016-4467]({{site_url}}/cves/CVE-2016-4467.html) | Medium | 0.8 through
0.13.0 inclusive | 0.13.1 and later | Failure to verify that the server host
name matches the certificate host name on Windows |
| [CVE-2016-2166]({{site_url}}/cves/CVE-2016-2166.html) | Moderate | 0.9
through 0.12.0 inclusive | 0.12.1 and later | Python bindings silently ignore
request for amqps if SSL/TLS not supported |
| [CVE-2019-0223]({{site_url}}/cves/CVE-2019-0223.html) | Important | 0.9
through 0.27.0 inclusive | 0.27.1 and later | TLS Man in the Middle
Vulnerability |
+| [CVE-2026-105031]({{site_url}}/cves/CVE-2026-105031.html) | Important |
versions through 0.40.0 inclusive | 0.41.1 and later | TLS implementation adds
to the existing trusted system trust anchors |
+| [CVE-2026-105042]({{site_url}}/cves/CVE-2026-105042.html) | Important |
versions through 0.40.0 inclusive | 0.41.1 and later | Unbounded recursion in
parsing AMQP message bodies can lead to crash |
+| [CVE-2026-114230]({{site_url}}/cves/CVE-2026-114230.html) | Important |
versions through 0.40.0 inclusive | 0.41.1 and later | Regular AMQP frames can
be sent as SASL frame |
+| [CVE-2026-115942]({{site_url}}/cves/CVE-2026-115942.html) | Low | versions
through 0.40.0 inclusive | 0.41.1 and later | Verifying non-compliant TLS
wildcard cert can cause stack buffer overflow read |
See the main [Security]({{site_url}}/security.html) page for general
information and details for other components.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
