Description
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 are vulnerable to this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | wildfly-security-manager | As shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 4.8.15-1.Final_redhat_00001.1.el6sso | RHSA-2019:4042, RHSA-2019:4041, RHSA-2019:4040 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.10-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.11-1.redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-5.SP3_redhat_00003.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.17-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.18-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-msc | 1.4.11-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.16-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-6.Final_redhat_00006.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-2.SP1_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-6.Final_redhat_00005.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-20.SP12_redhat_00009.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-7.SP7_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.26-2.SP3_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.5-4.GA_redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.4-3.Final_redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.5-4.GA_redhat_00002.1.el7eap | RHSA-2019:4019 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +1 | 1.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl-linux-x86_64 | 1.0.8-5.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.5-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
Advisories 9
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4042 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4041 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4040 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4020 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4018 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2973 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024