Description
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | richfaces +4 | 3.3.1-3.SP3_patch_01.ep5.el6 | RHSA-2013:1043 |
| Red Hat JBoss EAP 5 | richfaces +4 | 3.3.1-3.SP3_patch_01.ep5.el6 | RHSA-2013:1042 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP_SEC1-1.ep2.6.el4 | RHSA-2013:1044 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Pastea/CVE-2013-2165 ★ 0 · Nov 8, 2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.richfaces:richfaces | >= 3.1.0, < 3.3.3 | 3.3.3 | GHSA-4344-frcp-j22q |
| Maven | org.richfaces:richfaces | >= 4.0.0, < 4.3.2 | 4.3.2 | GHSA-4344-frcp-j22q |
Advisories 3
- RHSA-2013:1042 Red Hat Security Advisory: richfaces security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2013:1043 Red Hat Security Advisory: richfaces security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2013:1044 Red Hat Security Advisory: jboss-seam2 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- JVN#38787103 third-party-advisory
- https://access.redhat.com/security/cve/CVE-2013-2165
- https://bugzilla.redhat.com/show_bug.cgi?id=973570
- RHSA-2013:1045 vendor-advisory
- RHSA-2013:1041 vendor-advisory
- RHSA-2013:1043 vendor-advisory
- RHSA-2013:1044 vendor-advisory
- JVNDB-2013-000072 third-party-advisory
- RHSA-2013:1042 vendor-advisory
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
- 20200313 RichFaces exploitation toolkit mailing-list