Information disclosure in Apache Qpid Proton
CVE-2016-2166
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Vulnerability class: Information Disclosure
EPSS: 0.043 (90.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Apache Qpid_proton
- Fedoraproject Fedora — versions 23
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking)
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2016-2166?
- CVE-2016-2166 is a medium-severity vulnerability in Apache Qpid Proton, classified under Information Disclosure. CVSS score: 6.5/10. Published 2016-04-12.
- How severe is CVE-2016-2166?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2016-2166 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.