CVE-2019-0223

CVE-2019-0223 describes a critical vulnerability in Apache Qpid Proton versions 0.9 to 0.27.0, affecting its C library and language bindings when used with OpenSSL versions prior to 1.1.0. This flaw allows anonymous TLS connections even when peer certificate verification is configured, enabling potential man-in-the-middle attacks. Rated with a CVSS score of 7.4 (HIGH), the vulnerability has a network attack vector and high impact on confidentiality and integrity, despite high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.