Description
A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Soteria | before 1.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-4.redhat_00010.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.12-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.60.0-2.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-codehaus-jackson +4 | 1.9.13-10.redhat_00007.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-cryptacular | 1.2.4-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-5.b08_redhat_00004.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-glassfish-javamail | 1.6.2-2.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-10.SP3_redhat_00008.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.21-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-hibernate-commons-annotations | 5.0.5-1.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.4-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-core | 4.4.5-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.2-2.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.3-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.0-3.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jaxbintros | 1.0.3-1.GA_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-classfilewriter | 1.2.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-common-beans | 2.0.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-api_3.2_spec +1 | 1.0.2-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.31-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-invocation | 1.5.2-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-5.SP2_redhat_00003.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-openjdk-orb | 8.1.4-3.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-10.Final_redhat_00011.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-threads | 2.3.3-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-websocket-api_1.1_spec | 1.1.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common | 3.2.3-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.0.20-2.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups-azure | 1.2.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups-kubernetes | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.8-1.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-opensaml +13 | 3.3.1-1.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-7.Final_redhat_00006.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-9.SP8_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-slf4j-jboss-logmanager | 1.0.4-1.GA_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-smallrye-config | 1.3.6-1.SP01_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-smallrye-health | 1.0.2-2.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.30-2.SP2_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-weld-cdi-2.0-api | 2.0.0-4.SP1_redhat_00004.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.8-3.GA_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.8-3.GA_redhat_00002.1.el7eap | RHSA-2020:2059 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.12-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-ws-commons-XmlSchema | 2.2.4-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.2.5-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
Advisories 4
- WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2020:2059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2058 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026