NVD

Id
18439  
Name
CVE-2016-2166  
Description
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-04-12  
Modified Date
2016-08-01  
Seq
2016-2166  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
102426 18439 CVE-2016-2166 FEDORA-2016-e6e8436b98  View
102427 18439 CVE-2016-2166 http://packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.html  View
102428 18439 CVE-2016-2166 http://qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.html  View
102429 18439 CVE-2016-2166 20160323 CVE-2016-2166: Apache Qpid Proton python binding silently ignores request for "amqps" if SSL/TLS not supported  View
102430 18439 CVE-2016-2166 https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git;h=a058585  View
102431 18439 CVE-2016-2166 https://issues.apache.org/jira/browse/PROTON-1157  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1306 JVNDB-2016-002079 Apache Qpid Proton の複数のクラスにおける重要な情報を取得される脆弱性 Apache Qpid Proton の (1) proton.reactor.Connector、(2) proton.reactor.Container、および (3) proton.utils.BlockingConnection クラスは、 SSL サポートが無効の場合、amqps URI スキームの暗号化されていない接続を適切に使用しないため、重要な情報を取得される、またはデータを変更される脆弱性が存在します。 CVE-2016-2166 88672 CVE-2016-2166 18439 5.8 6.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002079.html 2016-03-09 2016-04-18 View