Synopsis

Moderate: Red Hat Enterprise MRG Messaging 2.3.3 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated Messaging component packages that fix one security issue and
multiple bugs are now available for Red Hat Enterprise MRG 2.3 for Red Hat
Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation
IT infrastructure for enterprise computing. MRG offers increased
performance, reliability, interoperability, and faster computing for
enterprise customers.

MRG Messaging is a high-speed reliable messaging distribution for Linux
based on AMQP (Advanced Message Queuing Protocol), an open protocol
standard for enterprise messaging that is designed to make mission critical
messaging widely available as a standard service, and to make enterprise
messaging interoperable across platforms, programming languages, and
vendors. MRG Messaging includes an AMQP 0-10 messaging broker; AMQP 0-10
client libraries for C++, Java JMS, and Python; as well as persistence
libraries and management tools.

It was discovered that the Qpid Python client library for AMQP did not
properly perform TLS/SSL certificate validation of the remote server's
certificate, even when the 'ssl_trustfile' connection option was specified.
A rogue server could use this flaw to conduct man-in-the-middle attacks,
possibly leading to the disclosure of sensitive information.
(CVE-2013-1909)

With this update, Python programs can instruct the library to validate
server certificates by specifying a path to a file containing trusted CA
certificates.

This issue was discovered by Petr Matousek of the Red Hat MRG Messaging
team.

This update also fixes multiple bugs. Documentation for these changes will
be available shortly from the Technical Notes document linked to in the
References section.

All users of the Messaging capabilities of Red Hat Enterprise MRG 2.3 are
advised to upgrade to these updated packages, which resolve the issues
noted in the Red Hat Enterprise MRG 2 Technical Notes. After installing the
updated packages, stop the cluster by either running "service qpidd stop"
on all nodes, or "qpid-cluster --all-stop" on any one of the cluster nodes.
Once stopped, restart the cluster with "service qpidd start" on all nodes
for the update to take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise MRG Messaging 2 for RHEL 6 x86_64
• Red Hat Enterprise MRG Messaging 2 for RHEL 6 i386
• MRG Grid Execute 2 x86_64

Fixes

• BZ - 928530 - CVE-2013-1909 python-qpid: client does not validate qpid server TLS/SSL certificate

CVEs

• CVE-2013-1909

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/index.html

Red Hat Enterprise MRG Messaging 2 for RHEL 6

SRPM
python-qpid-0.18-5.el6_4.src.rpm	SHA-256: 258edb9e0b0ff677edf34d5699a1d9a77f62090cf95cb3a82eaec3281f1292a5
qpid-cpp-0.18-17.el6_4.src.rpm	SHA-256: d9d8672675f6cd0d5310e8e54f0fb5d917330f8289c94075fd434ffb280baabd
qpid-java-0.18-8.el6_4.src.rpm	SHA-256: ac6ac1b33b7fb5f47e8514d77045a35aea85c77fcef7152facb1e775d3ee7396
qpid-qmf-0.18-18.el6_4.src.rpm	SHA-256: 56a61b4537e875a8f900919837c4c329ca1770a9230b72d6fac52b5dd81e52eb
qpid-tools-0.18-10.el6_4.src.rpm	SHA-256: 670464883fce7b853454e8ab48807d2139c936429cb451ec5340d2eea39b6994
x86_64
python-qpid-0.18-5.el6_4.noarch.rpm	SHA-256: 33e39ef778cff4adbd3dea039c740310c69674a60efd44f183481ebe885de770
python-qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: 408375b6a5601ee9a758a45d9dc8710f434216b30e7c497a80e455258fed586b
qpid-cpp-client-0.18-17.el6_4.i686.rpm	SHA-256: 8c2678e59436f59587b4e6ecacf15b8f3422bb5321de472a8131bf9a25025ffe
qpid-cpp-client-0.18-17.el6_4.x86_64.rpm	SHA-256: 99d207f377e80821851368b1c344f07c3a18b2d3d8ef10ceae30be3cee0559b7
qpid-cpp-client-devel-0.18-17.el6_4.x86_64.rpm	SHA-256: e9bcab02cc48588f866cf009434b41e2cc3b48cf27b4afadd300095a7d8d0e90
qpid-cpp-client-devel-docs-0.18-17.el6_4.noarch.rpm	SHA-256: b2ce4e59a378b885e9227b7c2b333cdc2cd2ded43fae690befea5bb15dd38529
qpid-cpp-client-rdma-0.18-17.el6_4.x86_64.rpm	SHA-256: 261a76c23f6d4ef0fee292f64e6ea2f3634e61fd6d6558a23f94df004d2f6566
qpid-cpp-client-ssl-0.18-17.el6_4.i686.rpm	SHA-256: f8b57e5cb799d21640ec006b29bbcc756ca023c45f754306d6f82517de7f1b57
qpid-cpp-client-ssl-0.18-17.el6_4.x86_64.rpm	SHA-256: 9972883d17d7bbed9274625a210731de6f14d037d06f75ed26804ed7e503481e
qpid-cpp-debuginfo-0.18-17.el6_4.i686.rpm	SHA-256: 699d78507634ed64d649a912a3f2c9cfcc0358f64e73fe3985046c3cecece36e
qpid-cpp-debuginfo-0.18-17.el6_4.x86_64.rpm	SHA-256: ac8c81753c41876a463ca6bbc611092c680968e8010442daa70915df1d19cadf
qpid-cpp-server-0.18-17.el6_4.i686.rpm	SHA-256: 8ec0fccfc7298dc42f0396d59c2646c4be8b88ec4c6125b814d5b2c6b3d6fc4b
qpid-cpp-server-0.18-17.el6_4.x86_64.rpm	SHA-256: 705e64df791cf094320467e09dbab01ee9f85141bc21256fa55ad7524df48948
qpid-cpp-server-cluster-0.18-17.el6_4.x86_64.rpm	SHA-256: cfe707e4b8251dc16334c0e06c3d98502a5237b73ba9cbd19fd4af7a0ec9e05b
qpid-cpp-server-devel-0.18-17.el6_4.x86_64.rpm	SHA-256: 2044f1cb447196dcd772b7ee24cc403e4293c164c777c93314b953f842746c54
qpid-cpp-server-rdma-0.18-17.el6_4.x86_64.rpm	SHA-256: 35de9423560d86fd60e92aab26d864a65b6c888e2ec2cb5043e0fa653fcff8dc
qpid-cpp-server-ssl-0.18-17.el6_4.x86_64.rpm	SHA-256: fd0f5c04adc6da97573f7a11d38556533c058179e87c5235262286365da7416d
qpid-cpp-server-store-0.18-17.el6_4.x86_64.rpm	SHA-256: f6d810436ab683d77288aeb77d9485af76ff27006a12400eb3bee47b8ee6e4af
qpid-cpp-server-xml-0.18-17.el6_4.x86_64.rpm	SHA-256: 881b9840b8ba6e52705d8c0f63f0740359b03bf161fbeccee634f89632e011af
qpid-java-client-0.18-8.el6_4.noarch.rpm	SHA-256: b889c752bf40e14d6b102065fe0936ecc40dbe74dd38a5b431dd9b7553739ec0
qpid-java-common-0.18-8.el6_4.noarch.rpm	SHA-256: 75cc81ff9c0e8572c252c76b7d242701ec17912e29aacf1a933fe812859dfbc4
qpid-java-example-0.18-8.el6_4.noarch.rpm	SHA-256: ca273cab6f5078f65dd6cf5b8650f4c789b34061c36f92253ddee0e6567b4869
qpid-qmf-0.18-18.el6_4.i686.rpm	SHA-256: c9d276817bc054d4a60fd465daadaab8237031126f28736ff391463561886d6d
qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: d6c75f4ebfb4e9c92f64f1abe75ba56d35bdd47e2aa35105b36abe109be7ea9c
qpid-qmf-debuginfo-0.18-18.el6_4.i686.rpm	SHA-256: e3eb31a7809e17be1e758f1b585035cec8b63686826401bc74e8f87eca581e9f
qpid-qmf-debuginfo-0.18-18.el6_4.x86_64.rpm	SHA-256: 25976991496ed4006a87890517b40dffa4e46f2be6216c16cacd6c3950dd68e2
qpid-qmf-devel-0.18-18.el6_4.x86_64.rpm	SHA-256: 6c67ef617f32934ca55e18d2af1d8bdeaeeb7336c6164b98b40c2d2343e67727
qpid-tools-0.18-10.el6_4.noarch.rpm	SHA-256: 4cb963404f429017c89e4752ab1b342446c496eee3f231430275ad53909b3a83
ruby-qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: 2d4b6a765b4a11f3380be7541f8317240c1ad4ce20c207e78f6c118149f1234d
i386
python-qpid-0.18-5.el6_4.noarch.rpm	SHA-256: 33e39ef778cff4adbd3dea039c740310c69674a60efd44f183481ebe885de770
python-qpid-qmf-0.18-18.el6_4.i686.rpm	SHA-256: d608cbfa8c4bad5d4bfe1aaceb09ee037b6a777fbad58439acf71deb5af5f1b4
qpid-cpp-client-0.18-17.el6_4.i686.rpm	SHA-256: 8c2678e59436f59587b4e6ecacf15b8f3422bb5321de472a8131bf9a25025ffe
qpid-cpp-client-devel-0.18-17.el6_4.i686.rpm	SHA-256: eb93d7d09f9e62a6901791ed3c21bfce8a66e6e4beb2fe4fce1c5c0a85ad0ff1
qpid-cpp-client-devel-docs-0.18-17.el6_4.noarch.rpm	SHA-256: b2ce4e59a378b885e9227b7c2b333cdc2cd2ded43fae690befea5bb15dd38529
qpid-cpp-client-rdma-0.18-17.el6_4.i686.rpm	SHA-256: ede064a2fef5065b1a25effd5e3a971c4ecd632eceef02640c27e9fda0c89b4d
qpid-cpp-client-ssl-0.18-17.el6_4.i686.rpm	SHA-256: f8b57e5cb799d21640ec006b29bbcc756ca023c45f754306d6f82517de7f1b57
qpid-cpp-debuginfo-0.18-17.el6_4.i686.rpm	SHA-256: 699d78507634ed64d649a912a3f2c9cfcc0358f64e73fe3985046c3cecece36e
qpid-cpp-server-0.18-17.el6_4.i686.rpm	SHA-256: 8ec0fccfc7298dc42f0396d59c2646c4be8b88ec4c6125b814d5b2c6b3d6fc4b
qpid-cpp-server-cluster-0.18-17.el6_4.i686.rpm	SHA-256: 88423c239434e822d3d9573d74b0edb4d86b3d0fe684f8badf55df2109276127
qpid-cpp-server-devel-0.18-17.el6_4.i686.rpm	SHA-256: bacf9b30fcc31c49b5d09a7992115082d9cbfa28699ff86ae3c710d902649479
qpid-cpp-server-rdma-0.18-17.el6_4.i686.rpm	SHA-256: 7b5044705a9a53c7764d6e8fadc9e786eb36f6afc332d99e4fd77f2c39a6c6ee
qpid-cpp-server-ssl-0.18-17.el6_4.i686.rpm	SHA-256: bd71d9737db213dad6044d78cf0affa478bbf9872b3a6bca5362120e29d614f6
qpid-cpp-server-store-0.18-17.el6_4.i686.rpm	SHA-256: d5b78ae09b2cb5702fe3ad07a66f52fac2263c475f0ed2de8799b64fdb70e9b5
qpid-cpp-server-xml-0.18-17.el6_4.i686.rpm	SHA-256: 1b64ae944a3eb4f480f413b892fdb01a16134baa69feb10e6ef547c58281569b
qpid-java-client-0.18-8.el6_4.noarch.rpm	SHA-256: b889c752bf40e14d6b102065fe0936ecc40dbe74dd38a5b431dd9b7553739ec0
qpid-java-common-0.18-8.el6_4.noarch.rpm	SHA-256: 75cc81ff9c0e8572c252c76b7d242701ec17912e29aacf1a933fe812859dfbc4
qpid-java-example-0.18-8.el6_4.noarch.rpm	SHA-256: ca273cab6f5078f65dd6cf5b8650f4c789b34061c36f92253ddee0e6567b4869
qpid-qmf-0.18-18.el6_4.i686.rpm	SHA-256: c9d276817bc054d4a60fd465daadaab8237031126f28736ff391463561886d6d
qpid-qmf-debuginfo-0.18-18.el6_4.i686.rpm	SHA-256: e3eb31a7809e17be1e758f1b585035cec8b63686826401bc74e8f87eca581e9f
qpid-qmf-devel-0.18-18.el6_4.i686.rpm	SHA-256: e4a49d81fd88113d98fe0c355f374babfe490704dfee39a4006312b3562ca63a
qpid-tools-0.18-10.el6_4.noarch.rpm	SHA-256: 4cb963404f429017c89e4752ab1b342446c496eee3f231430275ad53909b3a83
ruby-qpid-qmf-0.18-18.el6_4.i686.rpm	SHA-256: b31812f32fb1bbdd9d8ccb13e18f2cefa5442fcfdbb0dba34da7e896b013c04f

MRG Grid Execute 2

SRPM
python-qpid-0.18-5.el6_4.src.rpm	SHA-256: 258edb9e0b0ff677edf34d5699a1d9a77f62090cf95cb3a82eaec3281f1292a5
qpid-cpp-0.18-17.el6_4.src.rpm	SHA-256: d9d8672675f6cd0d5310e8e54f0fb5d917330f8289c94075fd434ffb280baabd
qpid-qmf-0.18-18.el6_4.src.rpm	SHA-256: 56a61b4537e875a8f900919837c4c329ca1770a9230b72d6fac52b5dd81e52eb
qpid-tools-0.18-10.el6_4.src.rpm	SHA-256: 670464883fce7b853454e8ab48807d2139c936429cb451ec5340d2eea39b6994
x86_64
python-qpid-0.18-5.el6_4.noarch.rpm	SHA-256: 33e39ef778cff4adbd3dea039c740310c69674a60efd44f183481ebe885de770
python-qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: 408375b6a5601ee9a758a45d9dc8710f434216b30e7c497a80e455258fed586b
qpid-cpp-client-0.18-17.el6_4.i686.rpm	SHA-256: 8c2678e59436f59587b4e6ecacf15b8f3422bb5321de472a8131bf9a25025ffe
qpid-cpp-client-0.18-17.el6_4.x86_64.rpm	SHA-256: 99d207f377e80821851368b1c344f07c3a18b2d3d8ef10ceae30be3cee0559b7
qpid-cpp-client-ssl-0.18-17.el6_4.i686.rpm	SHA-256: f8b57e5cb799d21640ec006b29bbcc756ca023c45f754306d6f82517de7f1b57
qpid-cpp-client-ssl-0.18-17.el6_4.x86_64.rpm	SHA-256: 9972883d17d7bbed9274625a210731de6f14d037d06f75ed26804ed7e503481e
qpid-cpp-debuginfo-0.18-17.el6_4.i686.rpm	SHA-256: 699d78507634ed64d649a912a3f2c9cfcc0358f64e73fe3985046c3cecece36e
qpid-cpp-debuginfo-0.18-17.el6_4.x86_64.rpm	SHA-256: ac8c81753c41876a463ca6bbc611092c680968e8010442daa70915df1d19cadf
qpid-cpp-server-0.18-17.el6_4.i686.rpm	SHA-256: 8ec0fccfc7298dc42f0396d59c2646c4be8b88ec4c6125b814d5b2c6b3d6fc4b
qpid-cpp-server-0.18-17.el6_4.x86_64.rpm	SHA-256: 705e64df791cf094320467e09dbab01ee9f85141bc21256fa55ad7524df48948
qpid-cpp-server-ssl-0.18-17.el6_4.x86_64.rpm	SHA-256: fd0f5c04adc6da97573f7a11d38556533c058179e87c5235262286365da7416d
qpid-qmf-0.18-18.el6_4.i686.rpm	SHA-256: c9d276817bc054d4a60fd465daadaab8237031126f28736ff391463561886d6d
qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: d6c75f4ebfb4e9c92f64f1abe75ba56d35bdd47e2aa35105b36abe109be7ea9c
qpid-qmf-debuginfo-0.18-18.el6_4.i686.rpm	SHA-256: e3eb31a7809e17be1e758f1b585035cec8b63686826401bc74e8f87eca581e9f
qpid-qmf-debuginfo-0.18-18.el6_4.x86_64.rpm	SHA-256: 25976991496ed4006a87890517b40dffa4e46f2be6216c16cacd6c3950dd68e2
qpid-tools-0.18-10.el6_4.noarch.rpm	SHA-256: 4cb963404f429017c89e4752ab1b342446c496eee3f231430275ad53909b3a83
ruby-qpid-qmf-0.18-18.el6_4.x86_64.rpm	SHA-256: 2d4b6a765b4a11f3380be7541f8317240c1ad4ce20c207e78f6c118149f1234d