Description
It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | picketlink | as shipped with Jboss Enterprise Application Server 7.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-commons-codec | 1.11.0-2.redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.7-2.redhat_00002.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.11-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.10-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-hornetq +3 | 2.4.7-7.Final_redhat_2.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.16-2.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-javassist | 3.23.2-2.GA_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.7-2.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.8-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-openjdk-orb | 8.1.3-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.9-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-2.Final_redhat_00002.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.6.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.0.19-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-17.SP12_redhat_00005.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-5.SP5_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.2-2.GA_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.5.1-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-wildfly-discovery +1 | 1.1.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.15-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.2-2.GA_redhat_00001.1.el7eap | RHSA-2019:1420 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.10-1.Final_redhat_00001.1.el6eap | RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419 |
Advisories 4
- WID-SEC-2022-1947 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- RHSA-2019:1420 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1421 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1419 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026