Description
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | jboss-as-ee +53 | 7.5.1-2.Final_redhat_3.1.ep6.el6 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.1-3.Final_redhat_3.ep6.el6 | RHBA-2015:1073 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.31-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.2.2-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.11-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.7-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.14-1.GA_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.5.1-5.Final_redhat_3.1.ep6.el6 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.1-3.Final_redhat_3.1.ep6.el6 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.1-6.Final_redhat_3.1.ep6.el6 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.9-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.29-1.Final_redhat_1.1.ep6.el5 | RHEA-2015:1076, RHEA-2015:1075, RHEA-2015:1074 |
Advisories 4
- RHEA-2015:1076 Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHEA-2015:1074 Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHEA-2015:1075 Red Hat Enhancement Advisory: Red Hat JBoss Enterprise Application Platform 6.4.1 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHBA-2015:1073 Red Hat Bug Fix Advisory: jboss-ec2-eap enhancement update for EAP 6.4.1 Red Hat Security Advisories (RHSA) · Aug 5, 2026