CVE-2021-20250 — JBoss EJB Client information disclosure vulnerability

Description

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.

Affected products

Vendor	Product	Affected	Fixed
—	wildfly	jboss-ejb-client 4.0.39	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.9.0-9.redhat_00019.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-bouncycastle +3	1.68.0-1.redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-guava +1	30.1.0-1.redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-guava-failureaccess	1.0.1-1.redhat_00002.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-hal-console	3.2.13-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.27-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.39-1.SP1_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.18-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.20-2.SP1_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-jboss-server-migration +21	1.7.2-5.Final_redhat_00006.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-narayana +10	5.9.11-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-undertow	2.0.34-1.SP1_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly +2	7.3.6-1.GA_redhat_00002.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-elytron +1	1.10.11-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.25-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk8 +1	7.3.6-1.GA_redhat_00002.1.el7eap	RHSA-2021:0873
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.14-1.Final_redhat_00001.1.el6eap	RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jboss:jboss-ejb-client	< 4.0.39	4.0.39	GHSA-2259-h742-5vr4

Advisories 5

RHSA-2021:0873 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:0874 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2021:0872 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2023-1272 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025

References

https://bugzilla.redhat.com/show_bug.cgi?id=1929479