Description
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | JBoss EAP | All versions before 7.2.6.GA | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.11-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-6.SP3_redhat_00004.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.14-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.9.10-1.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.1-1.redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +1 | 2.9.10-2.redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.27-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-7.Final_redhat_00007.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-3.SP2_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.42-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-21.SP12_redhat_00010.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.28-2.SP1_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-3.Final_redhat_00003.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.6-5.GA_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.18-2.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.6-5.GA_redhat_00001.1.el7eap | RHSA-2020:0160 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159 |
| Red Hat JBoss EAP 6 | glassfish-jsf12-eap6 | 1.2.15-11.b01_SP2_redhat_2.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-29.SP31_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.44-1.Final_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbosgi-repository | 2.1.0-3.Final_redhat_3.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jboss-as-ee +51 | 7.5.23-3.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jboss-as-weld +2 | 7.5.22-3.Final_redhat_4.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jboss-remoting3-jmx | 1.1.4-2.Final_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.5.23-4.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.23-2.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.31-1.Final_redhat_1.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.34-2.Final_redhat_2.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
Advisories 7
- RHSA-2020:0160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:0159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2781 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2780 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2779 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2169 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026