Vulnerability Description
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jgroups | < 4.0 |
| Redhat | Jboss Enterprise Application Platform | 5.2 |
| Redhat | Enterprise Linux | 5.0 |
References
- http://rhn.redhat.com/errata/RHSA-2016-1435.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1439.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2035.htmlVendor Advisory
- http://www.securityfocus.com/bid/91481VDB Entry
- http://www.securitytracker.com/id/1036165Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2016:1345Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1346Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1347Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1374Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1376Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1389Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1432Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1433Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1434Vendor Advisory
- https://issues.jboss.org/browse/JGRP-2021Issue TrackingVendor Advisory
FAQ
What is CVE-2016-2141?
CVE-2016-2141 is a vulnerability with a CVSS score of 9.8 (CRITICAL). It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use ...
How severe is CVE-2016-2141?
CVE-2016-2141 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-2141?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jgroups, Redhat Jboss Enterprise Application Platform, Redhat Enterprise Linux.