Description
PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.10-1.redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.27-6.redhat_8.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.23-5.Final_redhat_5.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-as-ee +55 | 7.3.2-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.25-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-el-api_2.2_spec | 1.0.4-2.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.27-2.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.0.9-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.2.19-1.GA_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.2-2.1.Final_redhat_2.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.2.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-4.SP4_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.14-2.redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
Advisories 2
- RHSA-2014:0343 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0344 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2014:0345 vendor-advisory
- RHSA-2015:0234 vendor-advisory
- RHSA-2015:0720 vendor-advisory
- RHSA-2015:0235 vendor-advisory
- RHSA-2014:0344 vendor-advisory
- RHSA-2014:0343 vendor-advisory