Threats tagged 'ghsa-75pq-3xrq-9pc6'

A vulnerability in Apache Qpid Proton C's OpenSSL TLS implementation causes the APIs pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() to add to rather than replace the default system trust anchors. This behavior can lead to trusting unexpected peer certificates. The issue does not affect the Win32 SChannel TLS implementation. It affects versions through 0.40.0 and is fixed in version 0.41.1.