Description
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | wildfly | jboss-ejb-client versions shipped with Red Hat JBoss EAP 7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-dom4j | 2.1.3-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.2.5-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-13.SP3_redhat_00011.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.23-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.17-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.19-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.22-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.4-1.redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.33-2.SP1_redhat_00001.1.el6eap | RHSA-2020:3142, RHSA-2020:3141 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-7.SP2_redhat_00005.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-13.Final_redhat_00014.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration-eap7.3-server +6 | 1.7.1-7.Final_redhat_00009.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-4.SP3_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.48-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-10.SP9_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.30-4.SP4_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.0.6-4.Final_redhat_00004.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.8-6.GA_redhat_00003.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.5.2-1.Final_redhat_00002.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.8-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.10.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:3463, RHSA-2020:3462, RHSA-2020:3461 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.21-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.8-6.GA_redhat_00003.1.el7eap | RHSA-2020:3638, RHSA-2020:3462, RHSA-2020:3142 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2020:3142, RHSA-2020:3141 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.11-1.Final_redhat_00001.1.el6eap | RHSA-2020:3639, RHSA-2020:3638, RHSA-2020:3637 |
| Red Hat A Mq Clients 2 | nodejs-rhea | 1.0.24-1.el8 | RHSA-2020:3817 |
| Red Hat A Mq Clients 2 | python3-qpid-proton | 0.32.0-2.el8 | RHSA-2020:3817 |
| Red Hat A Mq Clients 2 | qpid-cpp +3 | 1.36.0-31.el6_10amq | RHSA-2020:3817 |
| Red Hat A Mq Clients 2 | qpid-proton +9 | 0.32.0-1.el6_10 | RHSA-2020:3817 |
| Red Hat A Mq Clients 2 | rubygem-qpid_proton | 0.32.0-2.el7 | RHSA-2020:3817 |
Advisories 9
- RHSA-2020:3462 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3463 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3461 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3639 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:3817 Red Hat Security Advisory: AMQ Clients 2.8.0 Release Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3141 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3142 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026