GitStock

belaban/jgroups · Security

Improper Input Validation in JGroups

GHSA ID
GHSA-rc7h-x6cq-988q
CVE ID
CVE-2016-2141
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backported to versions 3.6.10.Final and 3.2.16.Final.

CWEs

  • CWE-20 · Improper Input Validation

References

Open GitHub