CVE-2016-2141
JGroups: Authorization bypass
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Red Hat. Niedriger laut Ubuntu (mittel).
Beschreibung
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jgroups:jgroups | 3.6.10.Final, 3.2.16.Final |
| debian 11 | libjgroups-java | kein Fix angegeben |
| debian 12 | libjgroups-java | kein Fix angegeben |
| debian 13 | libjgroups-java | kein Fix angegeben |
| debian 14 | libjgroups-java | kein Fix angegeben |
| echo | libjgroups-java | kein Fix angegeben |
| rapidfort debian 12 | libjgroups-java | kein Fix angegeben |
| rapidfort debian 13 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 20.04 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 22.04 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 24.04 | libjgroups-java | kein Fix angegeben |
| ubuntu 18.04-ESM | libjgroups-java | kein Fix angegeben |
Alle 17 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.jgroups:jgroups | 3.6.10.Final, 3.2.16.Final |
| debian 11 | libjgroups-java | kein Fix angegeben |
| debian 12 | libjgroups-java | kein Fix angegeben |
| debian 13 | libjgroups-java | kein Fix angegeben |
| debian 14 | libjgroups-java | kein Fix angegeben |
| echo | libjgroups-java | kein Fix angegeben |
| rapidfort debian 12 | libjgroups-java | kein Fix angegeben |
| rapidfort debian 13 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 20.04 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 22.04 | libjgroups-java | kein Fix angegeben |
| rapidfort ubuntu 24.04 | libjgroups-java | kein Fix angegeben |
| ubuntu 18.04-ESM | libjgroups-java | kein Fix angegeben |
| ubuntu 20.04-ESM | libjgroups-java | kein Fix angegeben |
| ubuntu 22.04 | libjgroups-java | kein Fix angegeben |
| ubuntu 24.04 | libjgroups-java | kein Fix angegeben |
| ubuntu 26.04 | libjgroups-java | kein Fix angegeben |
| ubuntu 26.10 | libjgroups-java | kein Fix angegeben |
Referenzen
- http://rhn.redhat.com/errata/RHSA-2016-1435.html
- http://rhn.redhat.com/errata/RHSA-2016-1439.html
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
- http://www.securityfocus.com/bid/91481
- http://www.securitytracker.com/id/1036165
- https://access.redhat.com/articles/2360521
- https://access.redhat.com/errata/RHSA-2016:1345
- https://access.redhat.com/errata/RHSA-2016:1346
Alle 36 Referenzen
- https://access.redhat.com/errata/RHSA-2016:1347
- https://access.redhat.com/errata/RHSA-2016:1374
- https://access.redhat.com/errata/RHSA-2016:1376
- https://access.redhat.com/errata/RHSA-2016:1389
- https://access.redhat.com/errata/RHSA-2016:1432
- https://access.redhat.com/errata/RHSA-2016:1433
- https://access.redhat.com/errata/RHSA-2016:1434
- https://access.redhat.com/security/cve/CVE-2016-2141
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2141
- https://github.com/belaban/JGroups
- https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36
- https://issues.jboss.org/browse/JGRP-2021
- https://issues.redhat.com/browse/JGRP-2055
- https://issues.redhat.com/browse/JGRP-2074
- https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E
- https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-2141
- https://rhn.redhat.com/errata/RHSA-2016-1328.html
- https://rhn.redhat.com/errata/RHSA-2016-1329.html
- https://rhn.redhat.com/errata/RHSA-2016-1330.html
- https://rhn.redhat.com/errata/RHSA-2016-1331.html
- https://rhn.redhat.com/errata/RHSA-2016-1332.html
- https://rhn.redhat.com/errata/RHSA-2016-1333.html
- https://rhn.redhat.com/errata/RHSA-2016-1334.html
- https://web.archive.org/web/20161013163606/http://www.securityfocus.com/bid/91481
- https://web.archive.org/web/20201207092245/http://www.securitytracker.com/id/1036165
- https://www.cve.org/CVERecord?id=CVE-2016-2141
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html