Description
JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-2.redhat_3.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | glassfish-jsf12-eap6 | 1.2_15-7.b01_redhat_11.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.7-8.SP4_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.14.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.23.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jboss-as-ee +59 | 7.3.3-3.Final_redhat_3.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.28-3.Final_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jboss-jstl-api_1.2_spec | 1.0.5-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jboss-weld-1.1-api | 1.1-9.Final_redhat_5.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.3-3.Final_redhat_3.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | jbossas-welcome-content-eap | 7.3.3-4.Final_redhat_3.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.0-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-6.SP6_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.9-4.SP3_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.7.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | weld-cdi-1.0-api | 1.0-10.SP4_redhat_4.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.17-3.SP2_redhat_1.1.ep6.el5 | RHSA-2014:0564, RHSA-2014:0563 |
Advisories 2
- RHSA-2014:0563 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.3 update Red Hat Security Advisories (RHSA) · May 15, 2026
- RHSA-2014:0564 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.3 update Red Hat Security Advisories (RHSA) · May 15, 2026
References
- RHSA-2014:0565 vendor-advisory
- RHSA-2015:0675 vendor-advisory
- RHSA-2015:0850 vendor-advisory
- RHSA-2014:0563 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- RHSA-2014:0564 vendor-advisory