VDB
RHSA-2016:1347
RHSA-2016:1347
PUBLISHED
CVSS 9.800000190734863 CRITICAL
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss BRMS 6.3 |
Timeline
- Jun 27, 2016 CVE Published
- Apr 30, 2026 Distribution Patch
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite&downloadType=securityPatches&version=6.3 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1313589 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1347.json advisory
- https://access.redhat.com/security/cve/CVE-2016-2141 advisory
- https://access.redhat.com/errata/RHSA-2016:1347 advisory
- https://access.redhat.com/articles/2360521 advisory
- https://www.cve.org/CVERecord?id=CVE-2016-2141 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141 advisory