CVE-2016-2166
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 4.3%
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Produtos afetados
n/a · n/aReferências
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.htmlhttp://packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.htmlhttp://qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.htmlhttps://git-wip-us.apache.org/repos/asf?p=qpid-proton.git%3Bh=a058585https://issues.apache.org/jira/browse/PROTON-1157https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3Ehttp://www.securityfocus.com/archive/1/537864/100/0/threaded