GHSA-rc7h-x6cq-988q
Improper Input Validation in JGroups
At a glance
- Published
- Updated
- CVE
- CVE-2016-2141
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backported to versions 3.6.10.Final and 3.2.16.Final.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jgroups:jgroups | introduced 3.3.0.Alpha1, fixed 3.6.10.Final |
| Maven · org.jgroups:jgroups | introduced 0, fixed 3.2.16.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141 ADVISORY
- https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36 WEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
- https://web.archive.org/web/20201207092245/http://www.securitytracker.com/id/1036165 WEB
- https://web.archive.org/web/20161013163606/http://www.securityfocus.com/bid/91481 WEB
- https://rhn.redhat.com/errata/RHSA-2016-1334.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1333.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1332.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1331.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1330.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1329.html WEB
- https://rhn.redhat.com/errata/RHSA-2016-1328.html WEB
- https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E WEB
- https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E WEB
- https://issues.redhat.com/browse/JGRP-2074 WEB
- https://issues.redhat.com/browse/JGRP-2055 WEB
- https://issues.jboss.org/browse/JGRP-2021 WEB
- https://github.com/belaban/JGroups PACKAGE
- https://access.redhat.com/errata/RHSA-2016:1434 WEB
- https://access.redhat.com/errata/RHSA-2016:1433 WEB
- https://access.redhat.com/errata/RHSA-2016:1432 WEB
- https://access.redhat.com/errata/RHSA-2016:1389 WEB
- https://access.redhat.com/errata/RHSA-2016:1376 WEB
- https://access.redhat.com/errata/RHSA-2016:1374 WEB
- https://access.redhat.com/errata/RHSA-2016:1347 WEB
- https://access.redhat.com/errata/RHSA-2016:1346 WEB
- https://access.redhat.com/errata/RHSA-2016:1345 WEB
- http://rhn.redhat.com/errata/RHSA-2016-1435.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-1439.html WEB
- http://rhn.redhat.com/errata/RHSA-2016-2035.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |