Description
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wildfly-core | Fixed in 16.0.1.Final, 17.0.0.Final and later. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.10.0-1.redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.16-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.20-4.SP2_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.35-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-2.redhat_00006.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.9-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.23-2.SP1_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-9.Final_redhat_00010.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-9.Final_redhat_00008.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.39-1.SP2_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.3.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.9-2.GA_redhat_00002.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.5-1.Final_redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.29-1.Final_redhat_00002.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.9-2.GA_redhat_00002.1.el7eap | RHSA-2021:3656, RHSA-2021:3467 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.14-2.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.wildfly.core:wildfly-server | < 16.0.1.Final | 16.0.1.Final | GHSA-w88m-2936-rmxr |
| Maven | org.wildfly.core:wildfly-server | >= 17.0.0.Beta2, < 17.0.0.Beta3 | 17.0.0.Beta3 | GHSA-w88m-2936-rmxr |
Advisories 7
- RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3468 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3467 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3466 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2022-0916 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 24, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1976052
- https://access.redhat.com/security/cve/CVE-2021-3644
- https://issues.redhat.com/browse/WFCORE-5511
- https://github.com/wildfly/wildfly-core/pull/4668
- https://github.com/wildfly/wildfly-core/commit/6d8db43cd43b5994b7a14003db978064e086090b
- https://github.com/wildfly/wildfly-core/commit/06dd9884f6ba50470b1fb5a35198a8784f037714