Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1Y2YtZjdweC14cG1o

Moderate severity vulnerability that affects org.apache.qpid:proton-j

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

Permalink: https://github.com/advisories/GHSA-f5cf-f7px-xpmh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1Y2YtZjdweC14cG1o
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 6 years ago
Updated: almost 2 years ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS Percentage: 0.00075
EPSS Percentile: 0.33501

Identifiers: GHSA-f5cf-f7px-xpmh, CVE-2016-2166
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-2166
• https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git;h=a058585
• https://github.com/advisories/GHSA-f5cf-f7px-xpmh
• https://issues.apache.org/jira/browse/PROTON-1157
• https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.html
• http://packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.html
• http://qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.html
• http://www.securityfocus.com/archive/1/537864/100/0/threaded

Repository: https://git-wip-us.apache.org/repos/asf/qpid-proton
Blast Radius: 17.7

Affected Packages