[ https://issues.jboss.org/browse/AS7-5577?page=com.atlassian.jira.plugin.s... ] Radoslav Husar moved JBPAPP-9954 to AS7-5577: --------------------------------------------- Project: Application Server 7 (was: JBoss Enterprise Application Platform) Key: AS7-5577 (was: JBPAPP-9954) Workflow: GIT Pull Request workflow (was: jira) Affects Version/s: 7.1.2.Final (EAP) 7.1.3.Final (EAP) (was: EAP 6.0.0 ER 7) Release Notes Docs Status: (was: Documented as Resolved Issue) Release Notes Text: (was: * Cause When a JGroups channel is started, the JGroups diagnostics service will be enabled by default with no authentication. This service is exposed via IP multicast. * Consequence An attacker on an adjacent network can exploit this flaw to read diagnostics information and invoke JMX operations on the server (limited remote code execution). * Fix The jgroups-diagnostics socket binding has been removed. * Result The JGroups diagnostics service is not exposed unless explicitly enabled. ) Component/s: Clustering (was: Clustering) Security: (was: JBoss Internal) Fix Version/s: 7.2.0.Alpha1 7.1.4.Final (EAP) (was: EAP 6.0.0) Docs QE Status: (was: NEW) -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira