TLS Man in the Middle Vulnerability
CVE: CVE-2019-0223
Component: qpid-proton
CWE: CWE-300
Severity: Important
CVSS v3: 7.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2019-04-23T00:00:00+00:00

A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted.

Statement: Red Hat OpenStack Platform 14 (and its Operational Tools) is impacted by this flaw; other supported versions are not vulnerable.

Red Hat Virtualization 4 uses qpid-proton for katello-agent, which always uses client certificate authentication.

Red Hat Update Infrastructure 3 is impacted by this flaw, however in its default configuration client certificate authentication is used and qpidd service, which uses qpid-proton, cannot be reach from other machines.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If you are on a self-registered Satellite, download all packages before stopping Satellite Server:

# yum update --downloadonly

Stop Katello services:

# katello-service stop

Update all packages:

# yum update

Perform the update:

# satellite-installer --upgrade

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If you are on a self-registered Satellite, download all packages before stopping Satellite Server:

# yum update --downloadonly

Stop Katello services:

# katello-service stop

Update all packages:

# yum update

Perform the update:

# satellite-installer --upgrade

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If you are on a self-registered Satellite, download all packages before stopping Satellite Server:

# yum update --downloadonly

Stop Katello services:

# katello-service stop

Update all packages:

# yum update

Perform the update:

# satellite-installer --upgrade

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
This attack will not work if client-certificate authentication is in place because anonymous ciphers would not then be available.
Another possible mitigation is to disable anonymous ciphers on clients.