Description
Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control certain applications' authorization decisions via a crafted application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-commons-daemon-eap6 | 1:1.0.15-4.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-commons-pool-eap6 | 1.6-6.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.6.6-20.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | atinject | 1-9.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | atinject-eap6 | 1-3.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-4.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | cxf-xjc-dv +3 | 2.6.0-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | dom4j +1 | 1.6.1-19.redhat_5.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | ecj3 | 1:3.7.2-6.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-javamail | 1.4.5-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jaxb +1 | 2.2.5-14.redhat_5.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jsf | 2.1.19-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | glassfish-jsf12 | 1.2_15-12_b01_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | guava +1 | 13.0.1-1.redhat_1.ep6.el5.1 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | h2database | 1.3.168-3_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hibernate4 +4 | 4.2.0-3.Final_redhat_1.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hibernate4-validator | 4.3.1-1.Final_redhat_1.1.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | hornetq +2 | 2.3.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpcomponents +1 | 6-7.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpcore +4 | 4.2.1-7.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | httpd +2 | 2.2.22-18.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | ironjacamar | 1.0.17-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jacorb-jboss | 2.3.2-11.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jansi | 1.9-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jaxbintros | 1.0.2-14.GA_redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-deployment | 1.3.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-framework-core | 2.1.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-metadata | 2.2.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-resolver | 3.0.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-spi | 3.2.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbosgi-vfs | 1.2.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.3-1_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-as-console | 1.5.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-as-ee +59 | 7.2.0-8.Final_redhat_8.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-common-beans +2 | 1.1.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-dmr | 1.1.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.21-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jaxrpc-api_1.1_spec | 1.0.1-4.Final_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jaxrs-api_1.1_spec | 1.0.1-7.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jms-api_1.1_spec +1 | 1.0.1-6.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.19.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.4.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.3.16-.GA.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.0.8-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.2.0-2.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-msc | 1.0.4-1.GA_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.6-2.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.2.16-1.GA_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.5-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-servlet-api_3.0_spec | 1.0.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jboss-threads +1 | 2.1.0-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.2.0-7.Final_redhat_7.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.4-3.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossweb | 7.2.0-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-api | 1.0.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-common | 2.1.1-1.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.1.3-1.Final_redhat_3.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-native | 4.1.1-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jbossws-spi | 2.1.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jcip-annotations | 1.0-3.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jcip-annotations-eap6 | 1.0-3.1.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | joda-time | 1.6.2-5.redhat_4.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | jul-to-slf4j-stub | 1.0.1-1.Final_redhat_1.1.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_cluster +1 | 1.2.4-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_cluster-native | 1.2.4-1.Final.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_jk +1 | 1.2.37-2.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.22-18.ep6.el6 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | netty | 3.6.2-1_redhat_1.1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | objectweb-asm-eap6 | 3.3.1-6.2.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | opensaml | 2.5.1-1.redhat_1.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | openws | 1.4.2-9_redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | org.osgi +2 | 4.2.0-9.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.17-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.6-3.Final_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | relaxngDatatype +1 | 2011.1-4.redhat_6.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.6-1.Final_redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | slf4j +1 | 1.7.2-10.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | slf4j-jboss-logmanager | 1.0.2-1.GA_redhat_1.3.ep6.el5.2 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | sun-ws-metadata-2.0-api | 1.0.MR1-12_MR1_redhat_3.ep6.el5.5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | tomcat-native +1 | 1.1.27-4.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | velocity-eap6 | 1.7-2.1.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0-8.SP4_redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.13-1.Final_redhat_1.ep6.el5.1 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-core | 4.2.0-7.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-core-asl | 4.2.0-7.redhat_2.ep6.el6 | RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | woodstox-stax2-api | 3.1.1-7.redhat_3.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | wsdl4j-eap6 | 1.6.2-12.3.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.9-2.redhat_2.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xerces-j2-eap6 | 2.9.1-14_redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xml-commons-resolver-eap6 | 1.2-10.redhat_3.ep6.el5.4 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.3-1.redhat_1.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
| Red Hat JBoss EAP 6 | xmltooling | 1.3.2-10.redhat_4.ep6.el5 | RHSA-2013:0839, RHSA-2013:0834 |
Advisories 2
- RHSA-2013:0839 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0834 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2013:0833 vendor-advisory
- RHSA-2013:1437 vendor-advisory
- RHSA-2013:0834 vendor-advisory