VDB
RHSA-2016%3A1389
RHSA-2016%3A1389
PUBLISHED
CVSS 9.800000190734863 CRITICAL
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Fuse Service Works 6.0 |
Timeline
- Jul 7, 2016 CVE Published
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2016:1389 advisory
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse.serviceworks&downloadType=securityPatches&version=6.0.0 advisory
- https://access.redhat.com/articles/2360521 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1313589 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1389.json advisory
- https://access.redhat.com/security/cve/CVE-2016-2141 advisory
- https://www.cve.org/CVERecord?id=CVE-2016-2141 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141 advisory