Description
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Wildfly | before wildfly-embedded-13.0.0.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.3-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-13.SP3_redhat_00011.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.23-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.22-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-7.SP2_redhat_00005.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-13.Final_redhat_00014.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration-eap7.3-server +6 | 1.7.1-7.Final_redhat_00009.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-4.SP3_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.48-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-10.SP9_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.30-4.SP4_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-4.Final_redhat_00004.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.9-4.GA_redhat_00003.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.5.2-1.Final_redhat_00002.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.10.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.22-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.9-4.GA_redhat_00003.1.el7eap | RHSA-2020:3638, RHSA-2020:3462 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
Advisories 7
- RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2022-1912 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2025