CVE-2016-2166

qpid-proton: reactor sends messages in clear if ssl is requested but not available

Published Apr 12, 2016 CVSS 3.0 · 6.5 Medium EPSS 4.3% KEV · Not listed
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2018-0588 The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Github GHSA Github GHSA GHSA-f5cf-f7px-xpmh Moderate severity vulnerability that affects org.apache.qpid:proton-j
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 11:17 PM
Reserved
Jan 29, 2016, 12:00 AM
Status
Modified
Published
Apr 12, 2016, 2:59 PM
Modified
Jun 17, 2026, 12:43 AM
Severity
Moderate
Public date
Mar 9, 2016, 12:00 AM