Description
Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | antlr-eap6 | 2.7.7-18.redhat_4.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.14-1.redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-6.redhat_7.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | guava-libraries | 13.0.1-4.redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.17-2.SP1_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.21.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-as-ee +53 | 7.4.3-3.Final_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.5-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossas-core +8 | 7.4.3-2.Final_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.26-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossweb | 7.4.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | jbossws-spi | 2.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.19-10.SP10_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketlink-bindings | 2.5.3-15.SP16_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.5.3-16.SP16_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.8-13.SP4_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | sun-istack-commons | 1:2.6.1-12.redhat_3.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | sun-saaj-1.3-impl | 1.3.16-11.SP1_redhat_2.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.17-2.SP1_redhat_1.1.ep6.el5 | RHSA-2015:0218, RHSA-2015:0217, RHSA-2015:0216 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.weld:weld-core-bom | < 2.2.8 | 2.2.8 | GHSA-338v-3958-8v8r |
Advisories 4
- RHSA-2015:0217 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0218 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0216 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.3 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
References
- https://github.com/weld/core/commit/29fd1107fd30579ad9bb23fae4dc3ba464205745
- https://github.com/weld/core/commit/8e413202fa1af08c09c580f444e4fd16874f9c65
- redhat-jboss-cve20148122-info-disc(100892) vdb-entry
- RHSA-2015:0675 vendor-advisory
- RHSA-2015:0773 vendor-advisory
- RHSA-2015:0920 vendor-advisory
- RHSA-2015:0850 vendor-advisory
- https://github.com/weld/core/commit/6808b11cd6d97c71a2eed754ed4f955acd789086
- 74252 vdb-entry
- RHSA-2015:0215 vendor-advisory
- RHSA-2015:0851 vendor-advisory
- https://github.com/victims/victims-cve-db/blob/master/database/java/2014/8122.yaml
- RHSA-2015:0217 vendor-advisory
- RHSA-2015:0218 vendor-advisory
- RHSA-2015:0216 vendor-advisory
- 1031741 vdb-entry