CVE-2020-1729 — Permissions bypass in SmallRye

Description

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2

Affected products

Vendor	Product	Affected	Fixed
—	SmallRye	SmallRye 1.6.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.9.0-4.redhat_00010.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.2.12-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-bouncycastle +3	1.60.0-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-codehaus-jackson +4	1.9.13-10.redhat_00007.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-cryptacular	1.2.4-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.6.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-glassfish-el +1	3.0.1-5.b08_redhat_00004.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-glassfish-javamail	1.6.2-2.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.5-10.SP3_redhat_00008.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hal-console	3.0.21-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hibernate +4	5.3.16-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-hibernate-commons-annotations	5.0.5-1.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-hibernate-search +5	5.10.7-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-httpcomponents-client	4.5.4-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-httpcomponents-core	4.4.5-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-infinispan +8	9.4.18-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.10.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jackson-databind	2.9.10.2-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jaegertracing-jaeger-client-java +2	0.34.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jakarta-el	3.0.3-1.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jandex	2.1.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jasypt	1.9.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-javaee-security-soteria +1	1.0.0-3.redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jaxbintros	1.0.3-1.GA_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-classfilewriter	1.2.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-common-beans	2.0.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-ejb-api_3.2_spec +1	1.0.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.31-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-genericjms	2.0.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-invocation	1.5.2-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	2.3.5-5.SP2_redhat_00003.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-modules	1.8.9-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-openjdk-orb	8.1.4-3.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.18-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-remoting-jmx	3.0.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-security-negotiation	3.0.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-server-migration +23	1.3.1-10.Final_redhat_00011.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-server-migration-eap7.3-server +6	1.7.1-5.Final_redhat_00006.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-threads	2.3.3-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-vfs	3.2.15-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jboss-websocket-api_1.1_spec	1.1.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jboss-weld-3.1-api +2	3.1.0-6.SP2_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-jbossws-common	3.2.3-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups	4.0.20-2.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups-azure	1.2.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-jgroups-kubernetes	1.0.13-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-microprofile-config +1	1.4.0-1.redhat_00003.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-health	2.2.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-metrics +1	2.3.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-opentracing +1	1.3.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-microprofile-rest-client +1	1.4.0-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-mod_cluster	1.4.1-1.Final_redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-narayana +10	5.9.8-1.Final_redhat_00002.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-opensaml +13	3.3.1-1.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-picketbox +1	5.0.3-7.Final_redhat_00006.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-picketlink-bindings +1	2.5.5-23.SP12_redhat_00012.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-resteasy +19	3.6.1-9.SP8_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-slf4j-jboss-logmanager	1.0.4-1.GA_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-config	1.3.6-1.SP01_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-health	1.0.2-2.redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-metrics	2.4.0-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-smallrye-opentracing	1.3.4-1.redhat_00004.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-snakeyaml	1.24.0-2.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-stax2-api	4.2.0-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-sun-istack-commons +2	3.0.10-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-txw2 +8	2.3.3-4.b02_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-undertow	2.0.30-2.SP2_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-weld-cdi-2.0-api	2.0.0-4.SP1_redhat_00004.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.1.4-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly +2	7.2.8-3.GA_redhat_00002.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.6.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-elytron-tool	1.10.6-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.20-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.2.8-3.GA_redhat_00002.1.el7eap	RHSA-2020:2512, RHSA-2020:2059
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.12-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-wildfly-transaction-client	1.1.10-1.Final_redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-woodstox-core	6.0.3-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7	eap7-ws-commons-XmlSchema	2.2.4-1.redhat_00001.1.el6eap	RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7	eap7-wss4j +6	2.2.5-1.redhat_00001.1.el6eap	RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.smallrye.config:smallrye-config	< 1.6.2	1.6.2	GHSA-54fx-gm74-q676

Advisories 7

RHSA-2020:2512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:2513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2020:2511 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2020:2059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:2058 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

https://bugzilla.redhat.com/show_bug.cgi?id=1802444