Description
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | concurrent | 1.3.4-7jpp.ep1.6.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jaf | 1.1.0-0jpp.ep1.10.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-javamail | 1.4.0-0jpp.ep1.8 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jsf | 1.2_04-1.p02.0jpp.ep1.18 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | glassfish-jstl | 1.2.0-0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3 +1 | 1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.6.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | hsqldb | 1:1.8.0.8-2.patch01.1jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jacorb | 2.3.0-1jpp.ep1.4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-cache | 1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-common | 1.2.1-0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-remoting | 2.2.2-3.SP4.0jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jboss-seam +1 | 1.2.1-1.ep1.3.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossas | 4.2.0-3.GA_CP02.ep1.3.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossweb | 2.0.0-3.CP05.0jpp.ep1.1 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossws-wsconsume-impl | 2.0.0-0jpp.ep1.3 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jbossxb | 1.0.0-2.SP1.0jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jcommon | 1.0.12-1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jfreechart | 1.0.9-1jpp.ep1.2.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | jgroups | 1:2.4.1-1.SP4.0jpp.ep1.2 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | rh-eap-docs +1 | 4.2.0-3.GA_CP02.ep1.1.el4 | RHSA-2008:0158 |
| Red Hat Rhel Application Stack 1 | wsdl4j | 1.6.2-1jpp.ep1.8 | RHSA-2008:0158 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.8 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-1.patch02.1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-1jpp.ep1.6.el4 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-2.patch01.1jpp.ep1.1 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jacorb +3 | 2.3.0-1jpp.ep1.4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-1.CP01.0jpp.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP4.0jpp.ep1.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.3.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP02.ep1.3.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-3.CP05.0jpp.ep1.1 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jbossws-jboss42 | 1.2.1-0jpp.ep1.2.el4 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.12-1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.9-1jpp.ep1.2.el4 | RHSA-2008:0213, RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.1-1.SP4.0jpp.ep1.2 | RHSA-2008:0151 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-3.GA_CP02.ep1.1.el4 | RHSA-2008:0213, RHSA-2008:0151 |
Advisories 3
- RHSA-2008:0158 Red Hat Security Advisory: JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0213 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0151 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP02 security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- http://sourceforge.net/project/shownotes.php?release_id=549490&group_id=22866
- RHSA-2008:0213 vendor-advisory
- RHSA-2008:0151 vendor-advisory
- http://jira.jboss.com/jira/browse/JBSEAM-2084
- 26850 vdb-entry
- 42631 vdb-entry
- ADV-2007-4215 vdb-entry
- RHSA-2008:0158 vendor-advisory
- 28077 third-party-advisory