CVE-2013-4112 — Exposure of Sensitive Information to an Unauthorized Actor in JGroup

Description

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libjgroups-java	2.12.2.Final-4	—
Debian 13	libjgroups-java	2.12.2.Final-4	—
Debian 12	libjgroups-java	2.12.2.Final-4	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 6	apache-commons-beanutils	1.8.3-12.redhat_3.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	apache-commons-daemon-jsvc-eap6	1:1.0.15-2.redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	apache-cxf	2.6.8-8.redhat_7.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	cxf-xjc-dv +3	2.6.0-2.redhat_4.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hibernate4 +4	4.2.0-7.SP1_redhat_1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hornetq	2.3.5-2.Final_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	hornetq-native +1	2.3.5-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	httpd +3	2.2.22-25.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	infinispan +4	5.2.7-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	ironjacamar +9	1.0.19-1.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jaxbintros	1.0.2-16.GA_redhat_6.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-aesh	0.33.7-2.redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-as-console	1.5.6-2.Final_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-as-ee +56	7.2.1-5.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.23-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-hal	1.5.7-1.Final_redhat_1.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-invocation	1.1.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.1-6.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-logmanager	1.4.3-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-marshalling	1.3.18-1.GA_redhat_1.1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-modules	1.2.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.7-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-security-negotiation	2.2.5-2.Final_redhat_2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jboss-stdio	1.0.2-1.GA_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-core +1	7.2.1-6.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-javadocs	7.2.1-2.Final_redhat_10.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossas-modules-eap	7.2.1-9.Final_redhat_10.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossts	1:4.17.7-4.Final_redhat_4.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossweb	7.2.2-1.Final_redhat_1.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossws-cxf	4.1.4-7.Final_redhat_7.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jbossws-spi +1	2.1.3-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0-4.redhat_4.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	jgroups	1:3.2.10-1.Final_redhat_2.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.0.2-1.Final_redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	mod_ssl	1:2.2.22-25.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	netty	3.6.6-2.Final_redhat_1.1.ep6.el6	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	opensaml	2.5.1-2.redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	openws	1.4.2-10.redhat_4.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	picketbox	4.0.17-3.SP2_redhat_2.1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	picketlink-federation	2.1.6.3-2.Final_redhat_2.2.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	wss4j	1.6.10-1.redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207
Red Hat JBoss EAP 6	xml-security	1.5.5-1.redhat_1.ep6.el5	RHSA-2013:1208, RHSA-2013:1207

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jgroups:jgroups	>= 3.0.0, < 3.2.9.Final	3.2.9.Final	GHSA-cc62-496p-hrr7
Maven	org.jgroups:jgroups	>= 3.3.0, < 3.3.3.Final	3.3.3.Final	GHSA-cc62-496p-hrr7

Advisories 2

RHSA-2013:1207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2013:1208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

RHSA-2014:0029 vendor-advisory
RHSA-2013:1209 vendor-advisory
RHSA-2013:1437 vendor-advisory
RHSA-2013:1207 vendor-advisory
RHSA-2013:1208 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=983489
RHSA-2013:1771 vendor-advisory