CVE-2020-10718: High severity redhat Jboss Fuse vulnerability
Published Apr 27, 2020
·Updated
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
Other sources
A flaw was found in Wildfly, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
The embedded managed process API has two methods exposed as public methods which can bypass the security manager.
— Red Hat
Affected Software
110 affected componentsFixes available
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea
0:2.1.3-1.redhat_00001.1.el6ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea
0:1.2.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea
0:2.3.5-13.SP3_redhat_00011.1.el6ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea
0:3.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea
0:5.3.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea
0:6.0.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.22-1.Final_redhat_00001.1.el6ea
0:1.4.22-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-databind<0:2.9.10.4-1.redhat_00001.1.el6ea
0:2.9.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms<0:2.0.6-1.Final_redhat_00001.1.el6ea
0:2.0.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager<0:2.1.15-1.Final_redhat_00001.1.el6ea
0:2.1.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-modules<0:1.8.10-1.Final_redhat_00001.1.el6ea
0:1.8.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.3.1-13.Final_redhat_00014.1.el6ea
0:1.3.1-13.Final_redhat_00014.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.6-4.SP3_redhat_00001.1.el6ea
0:3.7.6-4.SP3_redhat_00001.1.el6ea
redhat/eap7-resteasy<0:3.6.1-10.SP9_redhat_00001.1.el6ea
0:3.6.1-10.SP9_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.30-4.SP4_redhat_00001.1.el6ea
0:2.0.30-4.SP4_redhat_00001.1.el6ea
redhat/eap7-weld-core<0:3.0.6-4.Final_redhat_00004.1.el6ea
0:3.0.6-4.Final_redhat_00004.1.el6ea
redhat/eap7-wildfly<0:7.2.9-4.GA_redhat_00003.1.el6ea
0:7.2.9-4.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-elytron<0:1.6.8-1.Final_redhat_00001.1.el6ea
0:1.6.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.22-1.Final_redhat_00001.1.el6ea
0:1.0.22-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-transaction-client<0:1.1.11-1.Final_redhat_00001.1.el6ea
0:1.1.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el7ea
0:2.1.3-1.redhat_00001.1.el7ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el7ea
0:1.2.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el7ea
0:2.3.5-13.SP3_redhat_00011.1.el7ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el7ea
0:3.0.23-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el7ea
0:5.3.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el7ea
0:6.0.20-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.22-1.Final_redhat_00001.1.el7ea
0:1.4.22-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-databind<0:2.9.10.4-1.redhat_00001.1.el7ea
0:2.9.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms<0:2.0.6-1.Final_redhat_00001.1.el7ea
0:2.0.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager<0:2.1.15-1.Final_redhat_00001.1.el7ea
0:2.1.15-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-modules<0:1.8.10-1.Final_redhat_00001.1.el7ea
0:1.8.10-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.3.1-13.Final_redhat_00014.1.el7ea
0:1.3.1-13.Final_redhat_00014.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.6-4.SP3_redhat_00001.1.el7ea
0:3.7.6-4.SP3_redhat_00001.1.el7ea
redhat/eap7-resteasy<0:3.6.1-10.SP9_redhat_00001.1.el7ea
0:3.6.1-10.SP9_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.30-4.SP4_redhat_00001.1.el7ea
0:2.0.30-4.SP4_redhat_00001.1.el7ea
redhat/eap7-weld-core<0:3.0.6-4.Final_redhat_00004.1.el7ea
0:3.0.6-4.Final_redhat_00004.1.el7ea
redhat/eap7-wildfly<0:7.2.9-4.GA_redhat_00003.1.el7ea
0:7.2.9-4.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-elytron<0:1.6.8-1.Final_redhat_00001.1.el7ea
0:1.6.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.22-1.Final_redhat_00001.1.el7ea
0:1.0.22-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-transaction-client<0:1.1.11-1.Final_redhat_00001.1.el7ea
0:1.1.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el8ea
0:2.1.3-1.redhat_00001.1.el8ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el8ea
0:1.2.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el8ea
0:2.3.5-13.SP3_redhat_00011.1.el8ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el8ea
0:3.0.23-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el8ea
0:5.3.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el8ea
0:6.0.20-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.22-1.Final_redhat_00001.1.el8ea
0:1.4.22-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-databind<0:2.9.10.4-1.redhat_00001.1.el8ea
0:2.9.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms<0:2.0.6-1.Final_redhat_00001.1.el8ea
0:2.0.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager<0:2.1.15-1.Final_redhat_00001.1.el8ea
0:2.1.15-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-modules<0:1.8.10-1.Final_redhat_00001.1.el8ea
0:1.8.10-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.3.1-13.Final_redhat_00014.1.el8ea
0:1.3.1-13.Final_redhat_00014.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.6-4.SP3_redhat_00001.1.el8ea
0:3.7.6-4.SP3_redhat_00001.1.el8ea
redhat/eap7-resteasy<0:3.6.1-10.SP9_redhat_00001.1.el8ea
0:3.6.1-10.SP9_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.30-4.SP4_redhat_00001.1.el8ea
0:2.0.30-4.SP4_redhat_00001.1.el8ea
redhat/eap7-weld-core<0:3.0.6-4.Final_redhat_00004.1.el8ea
0:3.0.6-4.Final_redhat_00004.1.el8ea
redhat/eap7-wildfly<0:7.2.9-4.GA_redhat_00003.1.el8ea
0:7.2.9-4.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-elytron<0:1.6.8-1.Final_redhat_00001.1.el8ea
0:1.6.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.22-1.Final_redhat_00001.1.el8ea
0:1.0.22-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-transaction-client<0:1.1.11-1.Final_redhat_00001.1.el8ea
0:1.1.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-elytron-web<0:1.6.2-1.Final_redhat_00001.1.el6ea
0:1.6.2-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-11.SP11_redhat_00001.1.el6ea
0:2.3.9-11.SP11_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.9-1.Final_redhat_00001.1.el6ea
0:3.2.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.19-1.Final_redhat_00001.1.el6ea
0:9.4.19-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-databind<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-base<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00001.1.el6ea
0:2.10.4-1.redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.1-7.Final_redhat_00009.1.el6ea
0:1.7.1-7.Final_redhat_00009.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.8-1.SP1_redhat_00001.1.el6ea
0:3.7.8-1.SP1_redhat_00001.1.el6ea
redhat/eap7-netty<0:4.1.48-1.Final_redhat_00001.1.el6ea
0:4.1.48-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.2-4.GA_redhat_00002.1.el6ea
0:7.3.2-4.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-common<0:1.5.2-1.Final_redhat_00002.1.el6ea
0:1.5.2-1.Final_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.7-1.Final_redhat_00001.1.el6ea
0:1.10.7-1.Final_redhat_00001.1.el6ea
redhat/eap7-elytron-web<0:1.6.2-1.Final_redhat_00001.1.el7ea
0:1.6.2-1.Final_redhat_00001.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.9-11.SP11_redhat_00001.1.el7ea
0:2.3.9-11.SP11_redhat_00001.1.el7ea
redhat/eap7-hal-console<0:3.2.9-1.Final_redhat_00001.1.el7ea
0:3.2.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-infinispan<0:9.4.19-1.Final_redhat_00001.1.el7ea
0:9.4.19-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-databind<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-base<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00001.1.el7ea
0:2.10.4-1.redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.1-7.Final_redhat_00009.1.el7ea
0:1.7.1-7.Final_redhat_00009.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.8-1.SP1_redhat_00001.1.el7ea
0:3.7.8-1.SP1_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.48-1.Final_redhat_00001.1.el7ea
0:4.1.48-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.2-4.GA_redhat_00002.1.el7ea
0:7.3.2-4.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-common<0:1.5.2-1.Final_redhat_00002.1.el7ea
0:1.5.2-1.Final_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.7-1.Final_redhat_00001.1.el7ea
0:1.10.7-1.Final_redhat_00001.1.el7ea
redhat/eap7-elytron-web<0:1.6.2-1.Final_redhat_00001.1.el8ea
0:1.6.2-1.Final_redhat_00001.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.9-11.SP11_redhat_00001.1.el8ea
0:2.3.9-11.SP11_redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.2.9-1.Final_redhat_00001.1.el8ea
0:3.2.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-infinispan<0:9.4.19-1.Final_redhat_00001.1.el8ea
0:9.4.19-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-databind<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-base<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00001.1.el8ea
0:2.10.4-1.redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.1-7.Final_redhat_00009.1.el8ea
0:1.7.1-7.Final_redhat_00009.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.8-1.SP1_redhat_00001.1.el8ea
0:3.7.8-1.SP1_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.48-1.Final_redhat_00001.1.el8ea
0:4.1.48-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.2-4.GA_redhat_00002.1.el8ea
0:7.3.2-4.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-common<0:1.5.2-1.Final_redhat_00002.1.el8ea
0:1.5.2-1.Final_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.7-1.Final_redhat_00001.1.el8ea
0:1.10.7-1.Final_redhat_00001.1.el8ea
redhat Jboss Fuse=7.0.0
redhat Wildfly<13.0.0
Event History
Apr 27, 2020
Data Sourced
via Red Hat·07:20 PM
DescriptionSeverityAffected Software
Aug 6, 2020
CVE Published
12:00 AM
Sep 16, 2020
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
DescriptionWeakness
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2020-10718?
CVE-2020-10718 is considered a high severity vulnerability due to the potential for bypassing the security manager through exposed TCCL settings.
2
How do I fix CVE-2020-10718?
To remediate CVE-2020-10718, update your Wildfly installation to version 13.0.0 or later or apply the relevant patches provided by Red Hat.
3
Which versions of Wildfly are affected by CVE-2020-10718?
CVE-2020-10718 affects all versions of Wildfly prior to 13.0.0.
4
What software is primarily impacted by CVE-2020-10718?
The primary software impacted by CVE-2020-10718 is Wildfly, specifically versions prior to wildfly-embedded-13.0.0.Final.
5
Is there a workaround for CVE-2020-10718?
There is no documented workaround for CVE-2020-10718; the recommended action is to update to fixed versions.