CVE-2016-2141 Improper Input Validation in JGroups
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jgroups/jgroups(Maven) | >= 3.3.0.Alpha1, < 3.6.10.Final | 3.6.10.Final |
| org.jgroups/jgroups(Maven) | < 3.2.16.Final | 3.2.16.Final |
| org.jgroups/jgroups(Maven) | = 3.3.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.Beta2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.Beta3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.CR2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.4.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.5.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.3.6.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.0.Alpha3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.4.Final | No fix listed |
Show 122 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jgroups/jgroups(Maven) | = 3.4.5.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.6.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.7.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.4.8.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta4 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta5 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta6 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta7 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta8 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Beta9 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.CR2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.5.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.4 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.4.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.5.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.6.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.7.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.8.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.6.9.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.10.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.10.0.GA | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.10.1.GA | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Alpha3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Alpha4 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.Beta2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.0.GA | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.11.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR4 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR5 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.CR6 | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.1.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.1.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.1.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.12.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.6.17.GA | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.6.20.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.6.21.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 2.6.22.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.CR3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.CR4 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.CR5 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.10.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.11.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.12.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.13.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.14.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.16.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.4.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.5.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.6.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.7.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.8.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.0.9.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Alpha3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Beta | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.1.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.Alpha1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.Alpha2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.Alpha3 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.Beta1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.CR1 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.CR2 | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.0.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.1.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.10.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.11.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.12.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.13.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.2.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.3.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.4.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.5.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.6.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.7.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.8.Final | No fix listed |
| org.jgroups/jgroups(Maven) | = 3.2.9.Final | No fix listed |
| debian/libjgroups-java(Debian:12) | All versions | No fix listed |
| debian/libjgroups-java(Debian:12) | = 2.12.2.Final-5 | No fix listed |
| debian/libjgroups-java(Debian:12) | = 2.12.2.Final-6 | No fix listed |
| debian/libjgroups-java(Debian:13) | All versions | No fix listed |
| debian/libjgroups-java(Debian:13) | = 2.12.2.Final-6 | No fix listed |
| debian/libjgroups-java(Debian:14) | All versions | No fix listed |
| debian/libjgroups-java(Debian:14) | = 2.12.2.Final-6 | No fix listed |
| redhat jgroups | < 4.0 | 4.0 |
| redhat jboss enterprise application platform | = 5.2 | No fix listed |
| redhat jboss enterprise application platform | = 6.4 | No fix listed |
| redhat jboss enterprise application platform | = 7.0 | No fix listed |
| ubuntu/libjgroups-java(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libjgroups-java(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libjgroups-java(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/libjgroups-java(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2016:1345 vendor-advisory
- RHSA-2016:1346 vendor-advisory
- RHSA-2016:1347 vendor-advisory
- RHSA-2016:1374 vendor-advisory
- RHSA-2016:1376 vendor-advisory
- RHSA-2016:1389 vendor-advisory
- RHSA-2016:1432 vendor-advisory
- RHSA-2016:1433 vendor-advisory
- RHSA-2016:1434 vendor-advisory
- issues.jboss.org issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- RHSA-2016:1328 vendor-advisory
- RHSA-2016:1329 broken-link vendor-advisory
- RHSA-2016:1330 vendor-advisory
- RHSA-2016:1331 broken-link vendor-advisory
- RHSA-2016:1332 vendor-advisory
- RHSA-2016:1333 broken-link vendor-advisory
- RHSA-2016:1334 vendor-advisory
- www.oracle.com patch third-party-advisory
- RHSA-2016:1435 vendor-advisory
- RHSA-2016:1439 vendor-advisory
- RHSA-2016:2035 vendor-advisory
- github.com patch
- issues.redhat.com
- issues.redhat.com
- web.archive.org
- web.archive.org
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- github.com product
- Debian Security Tracker CVE-2016-2141 vendor-advisory
- 91481 vdb-entry
- 1036165 broken-link third-party-advisory vdb-entry
- [geode-dev] 20200407 JGroups vulnerabilty mailing-list
- [geode-dev] 20200407 Re: JGroups vulnerabilty mailing-list
- bugs.debian.org issue-tracking