Description
Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.10-1.redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.27-6.redhat_8.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.23-5.Final_redhat_5.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-as-ee +55 | 7.3.2-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.25-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-el-api_2.2_spec | 1.0.4-2.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.27-2.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.0.9-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.8-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.2.19-1.GA_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.3.2-2.1.Final_redhat_2.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.2.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-4.SP4_redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.14-2.redhat_1.1.ep6.el5 | RHSA-2014:0344, RHSA-2014:0343 |
Advisories 2
- RHSA-2014:0343 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0344 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2014:0345 vendor-advisory
- 57675 third-party-advisory
- RHSA-2014:0344 vendor-advisory
- RHSA-2014:0343 vendor-advisory
- 66596 vdb-entry