Apache Qpid Proton vulnerabilities

2 CVEs affecting Apache Qpid Proton, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4467, published 2017-05-02.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-2166, published 2016-04-12. Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days. The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an…
• CVE-2016-4467, published 2017-05-02. Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days. The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name…