Latest redhat wildfly Vulnerabilities

● CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Redhat Wildfly<27.0.0
Redhat Amq=2.0
Redhat Amq Online
Redhat Integration Camel K
Redhat Integration Service Registry
Redhat Jboss A-mq=7
and 2 more
● CVE-2022-0866
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.e...
redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el8
and 6 more
● CVE-2021-3644
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interfa...
redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea
redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea
and 41 more
● CVE-2021-3536
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affe...
redhat/Wildfly<23.0.2.
redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-3.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.33-1.Final_redhat_00001.1.el6ea
and 45 more
● CVE-2021-3503
A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.
maven/org.wildfly:wildfly-metrics<=23.0.0.Final
Redhat Wildfly<23.0.1
redhat/Wildfly<23.0.1.
● CVE-2020-27822
A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a po...
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea
and 58 more
● CVE-2020-25689
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able ...
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea
and 63 more
● CVE-2020-25640
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
redhat/Wildfly<21.0.0.
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea
and 53 more
● CVE-2020-14317
It was found that the issue for security flaw <a href="https://access.redhat.com/security/cve/CVE-2019-3805">CVE-2019-3805</a> appeared again in a further version of JBoss Enterprise Application Platf...
Redhat Jboss Enterprise Application Platform
Redhat Wildfly
● CVE-2020-10740
A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering cap...
maven/org.wildfly:wildfly-parent<20.0.0.Final
redhat/Wildfly<20.0.0.
redhat/eap7-jboss-ejb-client<0:4.0.33-2.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.2.8-6.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.21-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-naming-client<0:1.0.13-1.Final_redhat_00001.1.el6ea
and 120 more
● CVE-2020-10718
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a p...
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea
and 104 more
● CVE-2019-14887
It was found that the OpenSSL security provider does not honor TLS version in 'enabled-protocols' value of Wildfly's legacy security configuration. An attacker could target traffic sent over a TLS con...
redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea
redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea
redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea
redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea
redhat/eap7-hal-console<0:3.0.20-1.Final_redhat_00001.1.el6ea
and 224 more
● CVE-2020-1719
A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentia...
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea
redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea
and 262 more
● CVE-2019-3894
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if t...
redhat/eap7-activemq-artemis<0:2.6.3-5.redhat_00020.1.el6ea
redhat/eap7-apache-commons-lang<0:3.8.0-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.2.7-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf-xjc-utils<0:3.2.3-2.redhat_00002.1.el6ea
redhat/eap7-artemis-native<0:2.6.3-15.redhat_00020.el6ea
redhat/eap7-byte-buddy<0:1.9.5-1.redhat_00001.1.el6ea
and 72 more
● CVE-2019-3805
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploi...
Redhat Jboss Enterprise Application Platform=6.0.0
Redhat Jboss Enterprise Application Platform=7.0.0
Redhat Wildfly<=16.0.0
● CVE-2018-14627
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting all...
Redhat Wildfly<14.0.0
● CVE-2018-10683
** DISPUTED ** An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authent...
Redhat Wildfly=10.1.2
=10.1.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203