Skip to content
OpenAdvisories
High · 7.5 CVE-2018-14371 EUVD-2022-2283GHSA-43q7-q5vp-3g68

Path Traversal in Eclipse Mojarra

Published Jul 18, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: mojarra Package: org.glassfish:mojarra-parent Ecosystem: Maven Ecosystem: Ubuntu

Description

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mojarra No fix yet —
Ubuntu 26.04 LTS mojarra No fix yet —
Ubuntu 25.10 mojarra No fix yet —
Ubuntu 24.04 LTS mojarra No fix yet —
Ubuntu 22.04 LTS mojarra No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS mojarra No fix yet —
Ubuntu 18.04 LTS mojarra No fix yet —
Ubuntu 16.04 LTS mojarra No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-4.redhat_00010.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.3.5-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.60.0-2.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-codehaus-jackson +4 1.9.13-10.redhat_00007.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.6.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.5-11.SP3_redhat_00009.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hal-console 3.2.8-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.16-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-infinispan +8 9.3.9-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jackson-core +10 2.10.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jaegertracing-jaeger-client-java +2 0.34.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jakarta-el 3.0.3-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jandex 2.1.2-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.31-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 3.0.0-3.SP02_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-modules 1.10.0-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.18-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-remoting-jmx 3.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.1-5.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-vfs 3.2.15-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-weld-3.1-api +2 3.1.0-6.SP2_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-config +1 1.4.0-1.redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-health 2.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-metrics +1 2.3.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-opentracing +1 1.3.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-rest-client +1 1.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-opensaml +13 3.3.1-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-7.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketlink-bindings +1 2.5.5-23.SP12_redhat_00012.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.2-3.Final_redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-slf4j-jboss-logmanager 1.0.4-1.GA_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-config 1.6.2-3.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-health 2.2.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-metrics 2.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-opentracing 1.3.4-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-snakeyaml 1.24.0-2.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-stax2-api 4.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-sun-istack-commons +2 3.0.10-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-txw2 +8 2.3.3-4.b02_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-undertow 2.0.30-3.SP3_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.1.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.1-5.GA_redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.6-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.1-5.GA_redhat_00003.1.el7eap RHSA-2020:2512
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.12-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.11-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-woodstox-core 6.0.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wss4j +6 2.2.5-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.glassfish:mojarra-parent < 2.3.7 2.3.7 GHSA-43q7-q5vp-3g68

Advisories 7

References