CVE-2016-2141

Name of the Vulnerable Software and Affected Versions JGroups versions prior to 4.0 JGroups versions 3.6.x prior to 3.6.10.Final JGroups versions 3.2.x prior to 3.2.16.Final

Description The issue allows remote attackers to bypass security restrictions by not requiring necessary headers for the ENCRYPT and AUTH protocols from new nodes joining the cluster. This enables attackers to send and receive messages within the cluster, potentially leading to information disclosure, message spoofing, or further attacks.

Recommendations For JGroups versions prior to 3.2.16.Final, update to version 3.2.16.Final or later. For JGroups versions prior to 3.6.10.Final, update to version 3.6.10.Final or later. For JGroups versions prior to 4.0, update to version 4.0 or later.