{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Junos OS versions 15.1X53 ant\u00e9rieures \u00e0 15.1X53-D232 sur QFX5200/5110",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 17.1 ant\u00e9rieures \u00e0 17.1R2-S5, 17.1R3 et 17.1R3 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1 ant\u00e9rieures \u00e0 15.1F2-S17, 15.1F5-S8, 15.1F6-S8, 15.1R5-S7, 15.1R7",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.1 ant\u00e9rieures \u00e0 16.1R6 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1X53 ant\u00e9rieures \u00e0 15.1X53-D70, 15.1X53-D231",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.1 ant\u00e9rieures \u00e0 14.1R9 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.2 ant\u00e9rieures \u00e0 16.2R2, 16.2R2-S2, 16.2R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.2 ant\u00e9rieures \u00e0 14.2R8",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "CTPView versions 7.1, 7.2 et 7.3.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1 ant\u00e9rieures \u00e0 15.1F5-S8, 15.1F6-S8, 15.1R5-S6, 15.1R6-S3, 15.1R7, 15.1F6, 15.1R3",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1 ant\u00e9rieures \u00e0 15.1R6-S2, 15.1R7",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.1 ant\u00e9rieures \u00e0 16.1R5-S1, 16.1R6",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos Space ant\u00e9rieures \u00e0 17.2R1",
      "product": {
        "name": "Junos Space",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1 ant\u00e9rieures \u00e0 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.2 ant\u00e9rieures \u00e0 16.2R3 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1X49 versions 15.1X49-D100 et sup\u00e9rieures mais ant\u00e9rieures \u00e0 15.1X49-D121",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.1X53 ant\u00e9rieures \u00e0 14.1X53-D40 sur QFX, EX",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.2 ant\u00e9rieures \u00e0 14.2R8 sur MX series",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.1X46 ant\u00e9rieures \u00e0 12.1X46-D71",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1X49 ant\u00e9rieures \u00e0 15.1X49-D110 sur SRX",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "ScreenOS toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.1X65 ant\u00e9rieures \u00e0 16.1X65-D45",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.1 ant\u00e9rieures \u00e0 14.1R8-S5, 14.1R9",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3X48 ant\u00e9rieures \u00e0 12.3X48-D55 sur SRX",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1R5-S4, 15.1R5-S5 et 15.1R6",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.1X46 ant\u00e9rieures \u00e0 12.1X46-D71 sur SRX",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3 ant\u00e9rieures \u00e0 12.3R12-S7",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.1X53 ant\u00e9rieures \u00e0 14.1X53-D46, 14.1X53-D50 et 14.1X53-D107",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3R ant\u00e9rieures \u00e0 12.3R12-S7",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3X48 ant\u00e9rieures \u00e0 12.3X48-D55",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3R12 ant\u00e9rieures \u00e0 12.3R12-S7",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 12.3X48 versions 12.3X48-D55 et sup\u00e9rieures mais ant\u00e9rieures \u00e0 12.3X48-D65",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 17.2X75 ant\u00e9rieures \u00e0 17.2X75-D50",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1X53 ant\u00e9rieures \u00e0 15.1X53-D49, 15.1X53-D470 sur NFX",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 15.1X53 ant\u00e9rieures \u00e0 15.1X53-D65 sur QFX10K",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 16.1 ant\u00e9rieures \u00e0 16.1R3-S6, 16.1R4-S6 et 16.1R5",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Security Director et Log Collector ant\u00e9rieures \u00e0 17.2R1",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Junos OS versions 14.2 ant\u00e9rieures \u00e0 14.2R7-S9, 14.2R8",
      "product": {
        "name": "Junos OS",
        "vendor": {
          "name": "Juniper Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-3169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-3169"
    },
    {
      "name": "CVE-2017-14106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14106"
    },
    {
      "name": "CVE-2018-0002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0002"
    },
    {
      "name": "CVE-2015-5600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5600"
    },
    {
      "name": "CVE-2018-0008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0008"
    },
    {
      "name": "CVE-2015-6563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-6563"
    },
    {
      "name": "CVE-2018-0013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0013"
    },
    {
      "name": "CVE-2015-6564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-6564"
    },
    {
      "name": "CVE-2015-7236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7236"
    },
    {
      "name": "CVE-2017-7668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7668"
    },
    {
      "name": "CVE-2017-9798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-9798"
    },
    {
      "name": "CVE-2018-0011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0011"
    },
    {
      "name": "CVE-2016-2141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
    },
    {
      "name": "CVE-2015-7501",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
    },
    {
      "name": "CVE-2015-5304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5304"
    },
    {
      "name": "CVE-2018-0012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0012"
    },
    {
      "name": "CVE-2018-0003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0003"
    },
    {
      "name": "CVE-2017-9788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-9788"
    },
    {
      "name": "CVE-2015-5174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5174"
    },
    {
      "name": "CVE-2017-1000112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000112"
    },
    {
      "name": "CVE-2016-8858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8858"
    },
    {
      "name": "CVE-2017-5664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5664"
    },
    {
      "name": "CVE-2017-1000111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000111"
    },
    {
      "name": "CVE-2017-6074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-6074"
    },
    {
      "name": "CVE-2017-5645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5645"
    },
    {
      "name": "CVE-2018-0010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0010"
    },
    {
      "name": "CVE-2018-0005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0005"
    },
    {
      "name": "CVE-2018-0007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0007"
    },
    {
      "name": "CVE-2016-8655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8655"
    },
    {
      "name": "CVE-2017-3167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-3167"
    },
    {
      "name": "CVE-2015-5188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5188"
    },
    {
      "name": "CVE-2018-0009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0009"
    },
    {
      "name": "CVE-2017-7679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7679"
    },
    {
      "name": "CVE-2018-0004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0004"
    },
    {
      "name": "CVE-2018-0014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0014"
    },
    {
      "name": "CVE-2017-2634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-2634"
    },
    {
      "name": "CVE-2016-8743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8743"
    },
    {
      "name": "CVE-2015-5220",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5220"
    },
    {
      "name": "CVE-2018-0006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0006"
    },
    {
      "name": "CVE-2018-0001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-0001"
    }
  ],
  "initial_release_date": "2018-01-11T00:00:00",
  "last_revision_date": "2018-01-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-026",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-01-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nJuniper. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Juniper",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10838 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10838\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10831 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10831\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10835 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10835\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10833 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10833\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10837 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10837\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10841 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10841\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10828 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10828\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10834 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10834\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10829 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10829\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10836 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10836\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10839 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10839\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10830 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10830\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10832 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10832\u0026cat=SIRT_1\u0026actp=LIST"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA10840 du 10 janvier 2018",
      "url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10840\u0026cat=SIRT_1\u0026actp=LIST"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-2141"
    }
  },
  "description": "Red Hat JBoss Enterprise Application Platform\uff08EAP\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u57fa\u4e8eJ2EE\u7684\u4e2d\u95f4\u4ef6\u5e73\u53f0\u3002\r\n\r\nRed Hat JBoss EAP 5\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002",
  "discovererName": "Dennis Reed (Red Hat).",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://access.redhat.com/errata/RHSA-2016:1328",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-04393",
  "openTime": "2016-06-30",
  "patchDescription": "Red Hat JBoss Enterprise Application Platform\uff08EAP\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u3001\u57fa\u4e8eJ2EE\u7684\u4e2d\u95f4\u4ef6\u5e73\u53f0\u3002\r\n\r\nRed Hat JBoss EAP 5\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3002",
  "patchName": "Red Hat JBoss Enterprise Application Platform\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Red Hat JBoss Enterprise Application Platform 5"
  },
  "referenceLink": "https://access.redhat.com/errata/RHSA-2016:1328",
  "serverity": "\u4e2d",
  "submitTime": "2016-06-28",
  "title": "Red Hat JBoss Enterprise Application Platform\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jgroups:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEEE3873-17F7-4E5D-9C19-1C1BE698A17E",
              "versionEndExcluding": "4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "93F14D0A-4350-4141-B4C4-FBEBAAA4828D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2E0AFF9-F664-4D46-AEF4-07C725CC5448",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "88BF3B2C-B121-483A-AEF2-8082F6DA5310",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks."
    },
    {
      "lang": "es",
      "value": "JGroups en versiones anteriores a 4.0 no solicita las cabeceras adecuadas para los protocolos ENCRYPT y AUTH desde los nodos uni\u00e9ndose al grupo, lo que permite a atacantes remotos eludir las restricciones de seguridad y enviar y recibir mensajes dentro del grupo a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2016-2141",
  "lastModified": "2026-05-06T22:30:45.220",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-06-30T16:59:00.117",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1435.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1439.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91481"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1036165"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1345"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1346"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1347"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1374"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1389"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1432"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1433"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1434"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://issues.jboss.org/browse/JGRP-2021"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a%40%3Cdev.geode.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0%40%3Cdev.geode.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1328.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1329.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1330.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1331.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1332.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1333.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1334.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1435.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1439.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91481"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1036165"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1345"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1346"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1347"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1374"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1389"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1432"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1433"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2016:1434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://issues.jboss.org/browse/JGRP-2021"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a%40%3Cdev.geode.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0%40%3Cdev.geode.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1328.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1329.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1330.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1331.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1332.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1333.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1334.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jgroups:jgroups"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0.Alpha1"
            },
            {
              "fixed": "3.6.10.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jgroups:jgroups"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-2141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:02:18Z",
    "nvd_published_at": "2016-06-30T16:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backported to versions 3.6.10.Final and 3.2.16.Final.",
  "id": "GHSA-rc7h-x6cq-988q",
  "modified": "2023-06-01T19:57:55Z",
  "published": "2022-05-13T01:03:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20201207092245/http://www.securitytracker.com/id/1036165"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20161013163606/http://www.securityfocus.com/bid/91481"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1334.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1333.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1332.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1331.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1330.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1329.html"
    },
    {
      "type": "WEB",
      "url": "https://rhn.redhat.com/errata/RHSA-2016-1328.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://issues.redhat.com/browse/JGRP-2074"
    },
    {
      "type": "WEB",
      "url": "https://issues.redhat.com/browse/JGRP-2055"
    },
    {
      "type": "WEB",
      "url": "https://issues.jboss.org/browse/JGRP-2021"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/belaban/JGroups"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1434"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1433"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1432"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1389"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1374"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1347"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1346"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1345"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1435.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1439.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Input Validation in JGroups"
}

{
  "GSD": {
    "alias": "CVE-2016-2141",
    "description": "JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors.",
    "id": "GSD-2016-2141",
    "references": [
      "https://www.suse.com/security/cve/CVE-2016-2141.html",
      "https://access.redhat.com/errata/RHSA-2016:2035",
      "https://access.redhat.com/errata/RHSA-2016:1439",
      "https://access.redhat.com/errata/RHSA-2016:1435",
      "https://access.redhat.com/errata/RHSA-2016:1434",
      "https://access.redhat.com/errata/RHSA-2016:1433",
      "https://access.redhat.com/errata/RHSA-2016:1432",
      "https://access.redhat.com/errata/RHSA-2016:1389",
      "https://access.redhat.com/errata/RHSA-2016:1376",
      "https://access.redhat.com/errata/RHSA-2016:1374",
      "https://access.redhat.com/errata/RHSA-2016:1347",
      "https://access.redhat.com/errata/RHSA-2016:1346",
      "https://access.redhat.com/errata/RHSA-2016:1345",
      "https://access.redhat.com/errata/RHSA-2016:1334",
      "https://access.redhat.com/errata/RHSA-2016:1333",
      "https://access.redhat.com/errata/RHSA-2016:1332",
      "https://access.redhat.com/errata/RHSA-2016:1331",
      "https://access.redhat.com/errata/RHSA-2016:1330",
      "https://access.redhat.com/errata/RHSA-2016:1329",
      "https://access.redhat.com/errata/RHSA-2016:1328"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-2141"
      ],
      "details": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
      "id": "GSD-2016-2141",
      "modified": "2023-12-13T01:21:19.476497Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2016-2141",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2016:1347",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1347"
          },
          {
            "name": "RHSA-2016:2035",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
          },
          {
            "name": "RHSA-2016:1389",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1389"
          },
          {
            "name": "RHSA-2016:1345",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1345"
          },
          {
            "name": "RHSA-2016:1376",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1376"
          },
          {
            "name": "RHSA-2016:1330",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1330.html"
          },
          {
            "name": "RHSA-2016:1439",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1439.html"
          },
          {
            "name": "RHSA-2016:1331",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1331.html"
          },
          {
            "name": "91481",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/91481"
          },
          {
            "name": "RHSA-2016:1434",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1434"
          },
          {
            "name": "RHSA-2016:1328",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1328.html"
          },
          {
            "name": "RHSA-2016:1433",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1433"
          },
          {
            "name": "https://issues.jboss.org/browse/JGRP-2021",
            "refsource": "CONFIRM",
            "url": "https://issues.jboss.org/browse/JGRP-2021"
          },
          {
            "name": "RHSA-2016:1374",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1374"
          },
          {
            "name": "RHSA-2016:1432",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1432"
          },
          {
            "name": "RHSA-2016:1346",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1346"
          },
          {
            "name": "RHSA-2016:1334",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1334.html"
          },
          {
            "name": "RHSA-2016:1333",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1333.html"
          },
          {
            "name": "RHSA-2016:1329",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1329.html"
          },
          {
            "name": "RHSA-2016:1332",
            "refsource": "REDHAT",
            "url": "https://rhn.redhat.com/errata/RHSA-2016-1332.html"
          },
          {
            "name": "RHSA-2016:1435",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1435.html"
          },
          {
            "name": "1036165",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1036165"
          },
          {
            "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "name": "[geode-dev] 20200407 JGroups vulnerabilty",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E"
          },
          {
            "name": "[geode-dev] 20200407 Re: JGroups vulnerabilty",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,4.0)",
          "affected_versions": "All versions before 4.0.",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-264",
            "CWE-937"
          ],
          "date": "2019-04-23",
          "description": "JGroups does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors.",
          "fixed_versions": [
            "4.0"
          ],
          "identifier": "CVE-2016-2141",
          "identifiers": [
            "CVE-2016-2141"
          ],
          "not_impacted": "All versions starting from 4.0.",
          "package_slug": "maven/org.jgroups/jgroups",
          "pubdate": "2016-06-30",
          "solution": "Upgrade to version 4.0 or above.",
          "title": "Authorization bypass in JGroups",
          "urls": [
            "https://bugzilla.redhat.com/show_bug.cgi?id=1313589",
            "https://issues.jboss.org/browse/JGRP-2021"
          ],
          "uuid": "e03ae964-1815-4d53-8709-85335366d0c8"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:jgroups:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-2141"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:1334",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1334.html"
            },
            {
              "name": "RHSA-2016:1333",
              "refsource": "REDHAT",
              "tags": [
                "Broken Link",
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1333.html"
            },
            {
              "name": "https://issues.jboss.org/browse/JGRP-2021",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Vendor Advisory"
              ],
              "url": "https://issues.jboss.org/browse/JGRP-2021"
            },
            {
              "name": "1036165",
              "refsource": "SECTRACK",
              "tags": [
                "Broken Link",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id/1036165"
            },
            {
              "name": "RHSA-2016:1331",
              "refsource": "REDHAT",
              "tags": [
                "Broken Link",
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1331.html"
            },
            {
              "name": "RHSA-2016:1329",
              "refsource": "REDHAT",
              "tags": [
                "Broken Link",
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1329.html"
            },
            {
              "name": "RHSA-2016:1328",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1328.html"
            },
            {
              "name": "RHSA-2016:1332",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1332.html"
            },
            {
              "name": "RHSA-2016:1330",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://rhn.redhat.com/errata/RHSA-2016-1330.html"
            },
            {
              "name": "RHSA-2016:1346",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1346"
            },
            {
              "name": "RHSA-2016:1374",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1374"
            },
            {
              "name": "RHSA-2016:1389",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1389"
            },
            {
              "name": "RHSA-2016:1347",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1347"
            },
            {
              "name": "RHSA-2016:1345",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1345"
            },
            {
              "name": "RHSA-2016:1435",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1435.html"
            },
            {
              "name": "RHSA-2016:1433",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1433"
            },
            {
              "name": "RHSA-2016:1434",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1434"
            },
            {
              "name": "91481",
              "refsource": "BID",
              "tags": [
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/91481"
            },
            {
              "name": "RHSA-2016:1439",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1439.html"
            },
            {
              "name": "RHSA-2016:1432",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1432"
            },
            {
              "name": "RHSA-2016:1376",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2016:1376"
            },
            {
              "name": "RHSA-2016:2035",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2035.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "[geode-dev] 20200407 JGroups vulnerabilty",
              "refsource": "MLIST",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E"
            },
            {
              "name": "[geode-dev] 20200407 Re: JGroups vulnerabilty",
              "refsource": "MLIST",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-04-26T21:15Z",
      "publishedDate": "2016-06-30T16:59Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.\n\nThis asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1328",
        "url": "https://access.redhat.com/errata/RHSA-2016:1328"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1328.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:23:07+00:00",
      "generator": {
        "date": "2026-05-14T22:23:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:1328",
      "initial_release_date": "2016-06-23T21:07:16+00:00",
      "revision_history": [
        {
          "date": "2016-06-23T21:07:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-06-23T21:07:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:23:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
                  "product_id": "4AS-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
                  "product_id": "4ES-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el5.src",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el5.src",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el4.src",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el4.src",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el4?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el6.src",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el6.src",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el6?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el5.noarch",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el5.noarch",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el4.noarch",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el4.noarch",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el4?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:2.6.22-2.ep5.el6.noarch",
                "product": {
                  "name": "jgroups-1:2.6.22-2.ep5.el6.noarch",
                  "product_id": "jgroups-1:2.6.22-2.ep5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@2.6.22-2.ep5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS",
          "product_id": "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el4.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el4.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES",
          "product_id": "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.noarch"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el5.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.src"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.noarch"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:2.6.22-2.ep5.el6.src as a component of Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.src"
        },
        "product_reference": "jgroups-1:2.6.22-2.ep5.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
          "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
          "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
          "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
          "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.noarch",
          "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.src",
          "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.noarch",
          "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-23T21:07:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Application Platform 5 installation (including all\napplications and configuration files).\n\nThe JBoss server process must be restarted for the update to take effect.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.noarch",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.src",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.noarch",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1328"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.noarch",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.src",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.noarch",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4AS-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.noarch",
            "4ES-JBEAP-5:jgroups-1:2.6.22-2.ep5.el4.src",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.noarch",
            "5Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el5.src",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.noarch",
            "6Server-JBEAP-5:jgroups-1:2.6.22-2.ep5.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam.\n\nThis asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1329",
        "url": "https://access.redhat.com/errata/RHSA-2016:1329"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=5"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=5.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=5.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1329.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:23:07+00:00",
      "generator": {
        "date": "2026-05-14T22:23:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:1329",
      "initial_release_date": "2016-06-23T20:50:11+00:00",
      "revision_history": [
        {
          "date": "2016-06-23T20:50:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-06-23T20:50:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:23:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 5.2",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 5.2",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 5.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 5.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-23T20:50:11+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied. Also, back up your existing Red\nHat JBoss Enterprise Application Platform 5 installation (including all\napplications and configuration files).\n\nThe JBoss server process must be restarted for the update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 5.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1329"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 5.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 5.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.\n\nThis asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4 More information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1330",
        "url": "https://access.redhat.com/errata/RHSA-2016:1330"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "external",
        "summary": "1343598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1343598"
      },
      {
        "category": "external",
        "summary": "1343599",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1343599"
      },
      {
        "category": "external",
        "summary": "1343600",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1343600"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1330.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:23:07+00:00",
      "generator": {
        "date": "2026-05-14T22:23:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:1330",
      "initial_release_date": "2016-06-23T21:07:02+00:00",
      "revision_history": [
        {
          "date": "2016-06-23T21:07:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-06-23T21:07:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:23:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-6.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el5?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el5?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
                "product": {
                  "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
                  "product_id": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jgroups@3.2.16-1.Final_redhat_1.1.ep6.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-6.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src"
        },
        "product_reference": "jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-6.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
          "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
          "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
          "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
          "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
          "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-23T21:07:02+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1330"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.noarch",
            "5Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el5.src",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.noarch",
            "6Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el6.src",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.noarch",
            "7Server-JBEAP-6.4:jgroups-1:3.2.16-1.Final_redhat_1.1.ep6.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.\n\nThis asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4. More information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1331",
        "url": "https://access.redhat.com/errata/RHSA-2016:1331"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.4",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1331.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:23:07+00:00",
      "generator": {
        "date": "2026-05-14T22:23:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:1331",
      "initial_release_date": "2016-06-23T20:50:04+00:00",
      "revision_history": [
        {
          "date": "2016-06-23T20:50:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-06-23T20:50:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:23:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.4",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.4",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-23T20:50:04+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe JBoss server process must be restarted for the update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1331"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly.\n\nThis asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 7.0 More information about this vulnerability is available at: https://access.redhat.com/articles/2360521\n\nSecurity Fix(es):\n\n* It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks. (CVE-2016-2141)\n\nThe CVE-2016-2141 issue was discovered by Dennis Reed (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1332",
        "url": "https://access.redhat.com/errata/RHSA-2016:1332"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/",
        "url": "https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2360521",
        "url": "https://access.redhat.com/articles/2360521"
      },
      {
        "category": "external",
        "summary": "1313589",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1332.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:23:08+00:00",
      "generator": {
        "date": "2026-05-14T22:23:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2016:1332",
      "initial_release_date": "2016-06-23T20:49:52+00:00",
      "revision_history": [
        {
          "date": "2016-06-23T20:49:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-06-23T20:49:52+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:23:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server",
                  "product_id": "7Server-JBEAP-7.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-7.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
                "product": {
                  "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
                  "product_id": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-jgroups@3.6.8-3.Final_redhat_3.1.ep7.el7?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
                "product": {
                  "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
                  "product_id": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-jgroups@3.6.8-3.Final_redhat_3.1.ep7.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src",
                "product": {
                  "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src",
                  "product_id": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-jgroups@3.6.8-3.Final_redhat_3.1.ep7.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
                "product": {
                  "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
                  "product_id": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/eap7-jgroups@3.6.8-3.Final_redhat_3.1.ep7.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch"
        },
        "product_reference": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src"
        },
        "product_reference": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch"
        },
        "product_reference": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
        "relates_to_product_reference": "7Server-JBEAP-7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server",
          "product_id": "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src"
        },
        "product_reference": "eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src",
        "relates_to_product_reference": "7Server-JBEAP-7.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Reed"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-2141",
      "discovery_date": "2015-11-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1313589"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JGroups: Authorization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
          "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
          "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
          "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1313589",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313589"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2141"
        }
      ],
      "release_date": "2016-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-06-23T20:49:52+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe JBoss server process must be restarted for the update to take effect.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1332"
        },
        {
          "category": "workaround",
          "details": "Please refer to https://access.redhat.com/articles/2360521 for more information.",
          "product_ids": [
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.noarch",
            "6Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el6.src",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.noarch",
            "7Server-JBEAP-7.0:eap7-jgroups-0:3.6.8-3.Final_redhat_3.1.ep7.el7.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "JGroups: Authorization bypass"
    }
  ]
}