Все бюллетени/sisyphus/ALT-PU-2016-3246-2
ALT-PU-2016-3246-2

Обновление пакета qpid-proton в ветке sisyphus

Версия0.14.0-alt1
Задание#169029
Опубликовано2026-02-04
Макс. серьёзностьMEDIUM
Серьёзность:

Закрытые проблемы (3)

CVE-2016-2166
MEDIUM6.5

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

Опубликовано: 2016-04-12Изменено: 2025-04-12
CVSS 2.0СРЕДНЯЯ 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Ссылки
CVE-2016-4467
MEDIUM5.9

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

Опубликовано: 2017-05-02Изменено: 2025-04-20
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Ссылки
GHSA-f5cf-f7px-xpmh
MEDIUM6.5

Moderate severity vulnerability that affects org.apache.qpid:proton-j

Опубликовано: 2018-10-16Изменено: 2021-09-10
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Ссылки