Description
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | picketbox | redhat-picketbox 5.0.3.Final-redhat-00007 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-5.redhat_00011.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-native | 1:1.0.2-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-codec | 1.14.0-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-lang | 3.10.0-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.3.7-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-3.redhat_1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.65.0-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.9-11.SP12_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.12-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-core | 4.4.13-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jboss-invocation | 1.5.3-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-2.Final_redhat_00002.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.1.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-8.Final_redhat_00007.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-25.SP12_redhat_00013.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.26.0-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.31-1.SP1_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.2.0-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.3-4.GA_redhat_00004.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.3-4.GA_redhat_00004.1.el7eap | RHSA-2020:4246 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.13-1.Final_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-ws-commons-XmlSchema | 2.2.5-1.redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
| Red Hat JBoss EAP 7 | eap7-xerces-j2 | 2.12.0-2.SP03_redhat_00001.1.el6eap | RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244 |
Advisories 4
- RHSA-2020:4246 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:4245 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:4244 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.3 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2025-0019 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025