Description
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-10.SP9_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-11.SP9_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.36-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.7-2.Final_redhat_3.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.7-2.Final_redhat_3.ep6.el6 | RHSA-2016:0598 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.7-3.Final_redhat_3.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.13-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.33-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
Advisories 4
- RHSA-2016:0598 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0597 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0595 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0596 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2016:0599 vendor-advisory
- RHSA-2016:0596 vendor-advisory
- RHSA-2016:0595 vendor-advisory
- RHSA-2016:0598 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1308465
- RHSA-2016:0597 vendor-advisory