Skip to content
OpenAdvisories
Unscored RHSA-2015:1673 1 CVE

Red Hat Security Advisory: jboss-ec2-eap bug fix security update

Published Sep 29, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap 0:7.5.3-1.Final_redhat_2.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap-samples 0:7.5.3-1.Final_redhat_2.ep6.el6

Vulnerabilities 1

  • Medium —
    CVE-2015-3158

    PicketLink does not properly check role based authorization

    The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application r…

    org.picketlink:picketlink-tomcat-common Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1216123
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1673.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-3158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3158
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3158