Medium severity6.5NVD Advisory· Published Apr 12, 2016· Updated Jun 17, 2026
CVE-2016-2166
CVE-2016-2166
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.qpid:proton-jMaven | < 0.12.1 | 0.12.1 |
Affected products
3- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
11- qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.htmlnvdPatchVendor AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.htmlnvdThird Party AdvisoryWEB
- packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.htmlnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-f5cf-f7px-xpmhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-2166ghsaADVISORY
- www.securityfocus.com/archive/1/537864/100/0/threadednvdWEB
- git-wip-us.apache.org/repos/asfghsaWEB
- issues.apache.org/jira/browse/PROTON-1157nvdIssue TrackingWEB
- lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3EghsaWEB
- git-wip-us.apache.org/repos/asfnvd
- lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3Envd
News mentions
0No linked articles in our index yet.