Description
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | jbosssx2 | 2.0.5-9.SP3_1_patch_01.ep5.el5 | RHSA-2013:0230 |
| Red Hat JBoss EAP 6 | jboss-as-domain-management | 7.1.3-5.Final_redhat_5.ep6.el5 | RHSA-2013:0231 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.14-3.Final_redhat_3.ep6.el5 | RHSA-2013:0231 |
| Red Hat JBoss EAP 5 | jbosssx2 | 2.0.5-9.SP3_1_patch_01.ep5.el4 | RHSA-2013:0229 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 4 | jbossas +1 | 4.3.0-12.GA_CP10_patch_01.1.ep1.el4 | RHSA-2013:0249 |
Advisories 4
- RHSA-2013:0249 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0 CP10 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0229 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0230 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0231 Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2013:0234 vendor-advisory
- RHSA-2013:0586 vendor-advisory
- RHSA-2013:0248 vendor-advisory
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=885569
- RHSA-2013:0229 vendor-advisory
- RHSA-2013:0230 vendor-advisory
- RHSA-2013:0232 vendor-advisory
- RHSA-2013:0533 vendor-advisory
- RHSA-2013:0231 vendor-advisory
- RHSA-2013:0233 vendor-advisory