CVE-2022-0866
First published: Fri Mar 04 2022(Updated: )
A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/eap7-wildfly | <0:7.4.5-3.GA_redhat_00001.1.el8ea | 0:7.4.5-3.GA_redhat_00001.1.el8ea |
| redhat/eap7-wildfly | <0:7.4.5-3.GA_redhat_00001.1.el7ea | 0:7.4.5-3.GA_redhat_00001.1.el7ea |
| redhat/rh-sso7-keycloak | <0:15.0.8-1.redhat_00001.1.el7 | 0:15.0.8-1.redhat_00001.1.el7 |
| redhat/rh-sso7-keycloak | <0:15.0.8-1.redhat_00001.1.el8 | 0:15.0.8-1.redhat_00001.1.el8 |
| redhat/rh-sso7-keycloak | <0:18.0.3-1.redhat_00001.1.el7 | 0:18.0.3-1.redhat_00001.1.el7 |
| redhat/rh-sso7-keycloak | <0:18.0.3-1.redhat_00001.1.el8 | 0:18.0.3-1.redhat_00001.1.el8 |
| redhat/rh-sso7 | <0:1-5.el9 | 0:1-5.el9 |
| redhat/rh-sso7-javapackages-tools | <0:6.0.0-7.el9 | 0:6.0.0-7.el9 |
| redhat/rh-sso7-keycloak | <0:18.0.3-1.redhat_00001.1.el9 | 0:18.0.3-1.redhat_00001.1.el9 |
| Redhat Jboss Enterprise Application Platform | >=7.1.0 | |
| Redhat Openstack Platform | =13.0 | |
| Redhat Wildfly | >=11.0.0 | |
| redhat/wildfly | <26.1.1. | 26.1.1. |
| redhat/wildfly | <27.0.0. | 27.0.0. |
Remedy
In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2060929#c0
- https://access.redhat.com/errata/RHSA-2022:4922
- https://access.redhat.com/errata/RHSA-2022:4918
- https://access.redhat.com/errata/RHSA-2022:4919
- https://access.redhat.com/security/cve/cve-2022-0866
- https://access.redhat.com/errata/RHSA-2022:6782
- https://access.redhat.com/errata/RHSA-2022:6783
- https://access.redhat.com/errata/RHSA-2022:6787
- https://access.redhat.com/errata/RHSA-2022:7410
- https://access.redhat.com/errata/RHSA-2022:7409
- https://access.redhat.com/errata/RHSA-2022:7411
- https://access.redhat.com/errata/RHSA-2022:7417
- https://bugzilla.redhat.com/show_bug.cgi?id=2060929
- https://www.cve.org/CVERecord?id=CVE-2022-0866 https://nvd.nist.gov/vuln/detail/CVE-2022-0866
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-0866?
CVE-2022-0866 is a vulnerability in Wildfly that can result in an incorrect caller principal being returned from the session context of an EJB.
What is the severity of CVE-2022-0866?
CVE-2022-0866 has a severity rating of medium (3.1).
Which software versions are affected by CVE-2022-0866?
CVE-2022-0866 affects versions 7.4.5-3.GA_redhat_00001.1.el8ea and 7.4.5-3.GA_redhat_00001.1.el7ea of eap7-wildfly, and versions 15.0.8-1.redhat_00001.1.el7 and 15.0.8-1.redhat_00001.1.el8 of rh-sso7-keycloak.
How can I fix CVE-2022-0866?
To fix CVE-2022-0866, update your eap7-wildfly package to version 7.4.5-3.GA_redhat_00001.1.el8ea or 7.4.5-3.GA_redhat_00001.1.el7ea, or update your rh-sso7-keycloak package to version 15.0.8-1.redhat_00001.1.el7 or 15.0.8-1.redhat_00001.1.el8.
Where can I find more information about CVE-2022-0866?
You can find more information about CVE-2022-0866 on the Red Hat Security Advisory pages: [RHSA-2022:4922](https://access.redhat.com/errata/RHSA-2022:4922), [RHSA-2022:4918](https://access.redhat.com/errata/RHSA-2022:4918), [RHSA-2022:4919](https://access.redhat.com/errata/RHSA-2022:4919).
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0866
- agent/event
- package-manager/redhat
- vendor/redhat
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/7.1.0
- canonical/redhat openstack platform
- version/redhat openstack platform/13.0
- canonical/redhat wildfly
- version/redhat wildfly/11.0.0