CVE-2016-2166 Moderate severity vulnerability that affects org.apache.qpid:proton-j
MediumCVSS 6.5
EPSS 4.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.qpid/proton-j(Maven) | < 0.12.1 | 0.12.1 |
| org.apache.qpid/proton-j(Maven) | = 0.10 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.11.0 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.11.1 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.12.0 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.4 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.5 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.6 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.7 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.8 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.9 | No fix listed |
| org.apache.qpid/proton-j(Maven) | = 0.9.1 | No fix listed |
| apache qpid proton | <= 0.12.0 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- git-wip-us.apache.org
- github.com vendor-advisory
- issues.apache.org issue-tracking
- lists.apache.org
- FEDORA-2016-e6e8436b98 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit third-party-advisory
- qpid.apache.org patch vendor-advisory
- 20160323 CVE-2016-2166: Apache Qpid Proton python binding silently ignores request for 'amqps' if SSL/TLS not supported mailing-list
- Debian Security Tracker CVE-2016-2166 vendor-advisory
- git-wip-us.apache.org
- [qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223 mailing-list