Debian has JGroups 2.12, this version doesn't use authentication. An attacker can disrupt a node (stopping or slowing it down) but not execute arbitrary code.
Diagnostics are enabled by default. We can simply disable them by default. Emmanuel Bourg __ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
