Skip to content
OpenAdvisories
High · 7.8 CVE-2021-3717 EUVD-2022-4736GHSA-p9xf-3rm3-qh2h

Wildfly-Core user account mismanagement

Published May 24, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Package: org.wildfly.core:wildfly-core-parent Ecosystem: Maven

Description

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

Affected products

VendorProductAffectedFixed
— wildfly wildfly-core 17.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.1.16-4.redhat_00003.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-resteasy +16 3.0.27-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7 RHSA-2025:1746
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.9-2.GA_redhat_00002.1.ep7.el7 RHSA-2025:1746
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.3.12-1.redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-apache-sshd 2.7.0-1.redhat_00001.1.el7eap RHSA-2021:4677, RHSA-2021:4676
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.3-1.Final_redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-jakarta-el 3.0.3-3.redhat_00007.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.43-1.Final_redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-10.Final_redhat_00011.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-jsoup 1.14.2-1.redhat_00002.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.5-1.Final_redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-undertow 2.0.41-1.SP1_redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.10-2.GA_redhat_00003.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.15-1.Final_redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.10-2.GA_redhat_00003.1.el7eap RHSA-2021:5150, RHSA-2021:4676
Red Hat JBoss EAP 7 eap7-wss4j +6 2.2.7-1.redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149
Red Hat JBoss EAP 7 eap7-xml-security 2.1.7-1.redhat_00001.1.el6eap RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.core:wildfly-core-parent < 17.0 17.0 GHSA-p9xf-3rm3-qh2h

Advisories 7

References