VDB
RHSA-2016:1439
RHSA-2016:1439
PUBLISHED
CVSS 9.800000190734863 CRITICAL
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Single Sign-On 7.0 |
Timeline
- Jul 19, 2016 CVE Published
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://access.redhat.com/security/cve/CVE-2016-2141 advisory
- https://access.redhat.com/errata/RHSA-2016:1439 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.0 advisory
- https://access.redhat.com/articles/2360521 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1313589 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1439.json advisory
- https://www.cve.org/CVERecord?id=CVE-2016-2141 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141 advisory