{"id":"GHSA-rc7h-x6cq-988q","summary":"Improper Input Validation in JGroups","details":"JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backported to versions 3.6.10.Final and 3.2.16.Final.","aliases":["CVE-2016-2141"],"modified":"2024-03-09T05:19:09.364064Z","published":"2022-05-13T01:03:31Z","database_specific":{"github_reviewed_at":"2022-07-06T20:02:18Z","nvd_published_at":"2016-06-30T16:59:00Z","cwe_ids":["CWE-20"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2141"},{"type":"WEB","url":"https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36"},{"type":"WEB","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"WEB","url":"https://web.archive.org/web/20201207092245/http://www.securitytracker.com/id/1036165"},{"type":"WEB","url":"https://web.archive.org/web/20161013163606/http://www.securityfocus.com/bid/91481"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1334.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1333.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1332.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1331.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1330.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1329.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2016-1328.html"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E"},{"type":"WEB","url":"https://issues.redhat.com/browse/JGRP-2074"},{"type":"WEB","url":"https://issues.redhat.com/browse/JGRP-2055"},{"type":"WEB","url":"https://issues.jboss.org/browse/JGRP-2021"},{"type":"PACKAGE","url":"https://github.com/belaban/JGroups"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1434"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1433"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1432"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1389"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1376"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1374"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1347"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1346"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2016:1345"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2016-1435.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2016-1439.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2016-2035.html"}],"affected":[{"package":{"name":"org.jgroups:jgroups","ecosystem":"Maven","purl":"pkg:maven/org.jgroups/jgroups"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0.Alpha1"},{"fixed":"3.6.10.Final"}]}],"versions":["3.3.0.Alpha1","3.3.0.Alpha2","3.3.0.Beta1","3.3.0.Beta2","3.3.0.Beta3","3.3.0.CR1","3.3.0.CR2","3.3.0.Final","3.3.1.Final","3.3.2.Final","3.3.3.Final","3.3.4.Final","3.3.5.Final","3.3.6.Final","3.4.0.Alpha1","3.4.0.Alpha2","3.4.0.Alpha3","3.4.0.Beta1","3.4.0.Final","3.4.1.Final","3.4.2.Final","3.4.3.Final","3.4.4.Final","3.4.5.Final","3.4.6.Final","3.4.7.Final","3.4.8.Final","3.5.0.Alpha1","3.5.0.Beta1","3.5.0.Beta2","3.5.0.Beta3","3.5.0.Beta4","3.5.0.Beta5","3.5.0.Beta6","3.5.0.Beta7","3.5.0.Beta8","3.5.0.Beta9","3.5.0.CR1","3.5.0.CR2","3.5.0.Final","3.5.1.Final","3.6.0.Final","3.6.1.Final","3.6.2.Final","3.6.3.Final","3.6.4","3.6.4.Final","3.6.5.Final","3.6.6.Final","3.6.7.Final","3.6.8.Final","3.6.9.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rc7h-x6cq-988q/GHSA-rc7h-x6cq-988q.json"}},{"package":{"name":"org.jgroups:jgroups","ecosystem":"Maven","purl":"pkg:maven/org.jgroups/jgroups"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.16.Final"}]}],"versions":["2.10.0.CR1","2.10.0.GA","2.10.1.GA","2.11.0.Alpha1","2.11.0.Alpha2","2.11.0.Alpha3","2.11.0.Alpha4","2.11.0.Beta1","2.11.0.Beta2","2.11.0.GA","2.11.1.Final","2.12.0.Alpha1","2.12.0.Alpha2","2.12.0.Beta1","2.12.0.CR1","2.12.0.CR2","2.12.0.CR3","2.12.0.CR4","2.12.0.CR5","2.12.0.CR6","2.12.0.Final","2.12.1.1.Final","2.12.1.2.Final","2.12.1.3.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.6.17.GA","2.6.20.Final","2.6.21.Final","2.6.22.Final","3.0.0.Beta1","3.0.0.CR1","3.0.0.CR3","3.0.0.CR4","3.0.0.CR5","3.0.0.Final","3.0.1.Final","3.0.10.Final","3.0.11.Final","3.0.12.Final","3.0.13.Final","3.0.14.Final","3.0.16.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.0.5.Final","3.0.6.Final","3.0.7.Final","3.0.8.Final","3.0.9.Final","3.1.0.Alpha1","3.1.0.Alpha2","3.1.0.Alpha3","3.1.0.Beta","3.1.0.Beta1","3.1.0.Final","3.2.0.Alpha1","3.2.0.Alpha2","3.2.0.Alpha3","3.2.0.Beta1","3.2.0.CR1","3.2.0.CR2","3.2.0.Final","3.2.1.Final","3.2.10.Final","3.2.11.Final","3.2.12.Final","3.2.13.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final","3.2.6.Final","3.2.7.Final","3.2.8.Final","3.2.9.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rc7h-x6cq-988q/GHSA-rc7h-x6cq-988q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}