Skip to content
OpenAdvisories
Medium · 5.2 CVE-2019-14838 EUVD-2022-3088GHSA-82v2-f875-73g9

Wildfly Authorization Misconfiguration

Published Oct 14, 2019 · Updated Aug 5, 2024 · Assigned by redhat

Vendor: Red Hat Product: wildfly-core Package: org.wildfly.core:wildfly-host-controller Ecosystem: Maven

Description

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

Affected products

VendorProductAffectedFixed
Red Hat wildfly-core before 7.2.5.GA —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Single Sign On 7 rh-sso7-keycloak +1 4.8.15-1.Final_redhat_00001.1.el6sso RHSA-2019:4042, RHSA-2019:4041, RHSA-2019:4040
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.2.10-1.redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-byte-buddy 1.9.11-1.redhat_00002.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.5-5.SP3_redhat_00003.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-hal-console 3.0.17-2.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.13-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.18-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.2-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-jboss-msc 1.4.11-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.16-2.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-jboss-server-migration +23 1.3.1-6.Final_redhat_00006.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.6-2.SP1_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-6.Final_redhat_00005.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-20.SP12_redhat_00009.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-resteasy +19 3.6.1-7.SP7_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly +2 7.2.4-2.SP1_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.6.5-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly-elytron-tool 1.4.4-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.17-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.2.4-2.SP1_redhat_00001.1.el7eap RHSA-2019:4019, RHSA-2019:3082
Red Hat JBoss EAP 7 eap7-wildfly-openssl +1 1.0.8-1.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-wildfly-openssl-linux-x86_64 1.0.8-5.Final_redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018
Red Hat JBoss EAP 7 eap7-yasson 1.0.5-1.redhat_00001.1.el6eap RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.core:wildfly-host-controller < 7.2.5.GA 7.2.5.GA GHSA-82v2-f875-73g9

Advisories 7

References