REDHAT-BUG-843358: Medium severity JBoss JBoss Application Server vulnerability

Published Jul 26, 2012

Updated

When using multi-user authentication provided by the "allow-multiple-users" option for the datasource's connection pool together with a security domain, the credentials provided as arguments to the getConnection(uid,pwd) function are ignored. This means that a valid connection will be returned for an invalid credential.

This could also mean that, provided the correct subject, a datasource connection can be obtained that which might belong to a privileged user.

A fix for this issue is already available up-stream. The up-stream fix is located at [jira JBJCA-864].

Affected Software

1 affected component

JBoss JBoss Application Server

Event History

Jul 26, 2012

Data Sourced

06:37 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-843358?

The severity of REDHAT-BUG-843358 is considered to be critical due to its impact on user authentication.

How do I fix REDHAT-BUG-843358?

To fix REDHAT-BUG-843358, ensure that the datasource's connection pool is appropriately configured without the 'allow-multiple-users' option when using a security domain.

What systems are affected by REDHAT-BUG-843358?

REDHAT-BUG-843358 affects the JBoss Application Server when utilizing multi-user authentication.

What happens if I do not address REDHAT-BUG-843358?

Failing to address REDHAT-BUG-843358 could lead to unauthorized access as credentials may be ignored during connection attempts.

Is there a workaround for REDHAT-BUG-843358?

A temporary workaround for REDHAT-BUG-843358 is to disable the 'allow-multiple-users' option in the datasource configuration.