CVE-2016-2166
Moderate severity vulnerability that affects org.apache.qpid:proton-j
6.5
MEDIUM
CVSS 3.1
EPSS 0.27%
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
How to fix CVE-2016-2166
To remediate CVE-2016-2166, upgrade the affected package to a fixed version below.
- —upgrade to 0.12.1 or later
Is CVE-2016-2166 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.12.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |