VDB
RHSA-2016:1374
RHSA-2016:1374
PUBLISHED
CVSS 9.800000190734863 CRITICAL
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Portal 6.2 |
Timeline
- Jun 29, 2016 CVE Published
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Portal/ advisory
- https://www.cve.org/CVERecord?id=CVE-2016-2141 advisory
- https://access.redhat.com/errata/RHSA-2016:1374 advisory
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal&downloadType=securityPatches&version=6.2.0 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1313589 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1374.json advisory
- https://access.redhat.com/security/cve/CVE-2016-2141 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141 advisory