Medium severity6.5NVD Advisory· Published Apr 12, 2016· Updated May 6, 2026
CVE-2016-2166
CVE-2016-2166
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.qpid:proton-jMaven | < 0.12.1 | 0.12.1 |
Affected products
2- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.htmlnvdPatchVendor AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.htmlnvdThird Party AdvisoryWEB
- packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.htmlnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-f5cf-f7px-xpmhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-2166ghsaADVISORY
- www.securityfocus.com/archive/1/537864/100/0/threadednvdWEB
- git-wip-us.apache.org/repos/asfghsaWEB
- issues.apache.org/jira/browse/PROTON-1157nvdIssue TrackingWEB
- lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3EghsaWEB
- git-wip-us.apache.org/repos/asfnvd
- lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3Envd
News mentions
0No linked articles in our index yet.