Description
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | wildfly | affects up to 16.0.0.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +16 | 2.6.3-5.redhat_00020.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-lang | 3.8.0-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.7-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 2.6.3-15.redhat_00020.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.5-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-cxf-xjc-dv +5 | 3.2.3-2.redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.1-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.9-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-asyncclient | 4.1.4-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.3.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +5 | 2.9.8-2.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jackson-modules-base +4 | 2.9.8-1.redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.13-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.1-2.Final_redhat_00002.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.7-3.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.5-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +22 | 1.3.0-7.Final_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-16.SP12_redhat_4.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-4.SP3_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.7-2.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.7-2.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.1-6.GA_redhat_00004.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.1-6.GA_redhat_00004.1.el7eap | RHSA-2019:1108 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.2-1.redhat_00001.1.el6eap | RHSA-2019:1108, RHSA-2019:1107 |
Advisories 2
- RHSA-2019:1108 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1107 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3805
- RHSA-2019:1107 vendor-advisory
- RHSA-2019:1108 vendor-advisory
- RHSA-2019:1106 vendor-advisory
- RHSA-2019:1140 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190517-0004/
- RHSA-2019:2413 vendor-advisory
- RHSA-2020:0727 vendor-advisory