Skip to content
OpenAdvisories
High · 7.3 CVE-2024-1233 EUVD-2024-1305GHSA-v4mm-q8fv-r2w5

Eap: wildfly-elytron has a ssrf security issue

Published Apr 9, 2024 · Updated Oct 1, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat JBoss Enterprise Application Platform Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Product: Red Hat JBoss Enterprise Application Platform 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Package: org.wildfly.security:wildfly-elytron-realm-token Ecosystem: Maven

Description

A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.

Affected products

VendorProductAffectedFixed
— wildfly < 32.0.0.Final 32.0.0.Final
Red Hat Red Hat JBoss Enterprise Application Platform — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 — —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-glassfish-el +1 3.0.1-4.b08_redhat_00005.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +5 5.1.17-3.Final_redhat_00004.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-core +4 2.10.4-3.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-datatype-jdk8 +2 2.10.4-2.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-modules-base +1 2.10.4-5.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-ejb-client 4.0.12-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-16.Final_redhat_00017.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-2.Final_redhat_00003.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.11-4.GA_redhat_00002.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.14-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron-tool 1.10.17-1.Final_redhat_00001.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-http-client +4 1.0.21-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.14-3.GA_redhat_00002.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-naming-client 1.0.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl-linux 1.0.12-6.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.21.0-4.redhat_00048.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-amazon-ion-java 1.0.2-4.redhat_00005.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-angus +1 2.0.2-3.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-antlr4 +1 4.10.1-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.9.4-12.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.15.0-5.redhat_00015.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-apache-commons-io 2.11.0-2.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.0-2.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-apache-sshd 2.12.1-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-atinject +1 2.0.1-2.redhat_00005.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-caffeine 3.1.8-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-elytron-web 4.0.1-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-fge-btf 1.2.0-2.redhat_00017.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-fge-msg-simple 1.1.0-2.redhat_00015.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-gson 2.8.9-2.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-guava +1 32.1.2-1.jre_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.1-4.redhat_00012.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-hal-console 3.6.18-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.18-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-hibernate-search +6 6.2.2-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-hibernate-validator +1 8.0.1-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-2.redhat_00004.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-2.redhat_00010.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-2.redhat_00008.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-infinispan +20 14.0.24-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-ironjacamar +8 3.0.8-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jackson-core +12 2.15.4-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-activation 2.1.2-2.redhat_00005.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-annotation-api 2.1.1-4.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-batch-api 2.1.1-3.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-interceptor-api 2.1.0-4.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-jms-api 3.1.0-4.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-json 1.1.6-4.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-json-api 2.1.2-3.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-mail 2.1.2-2.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-4.redhat_00005.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-transaction-api 2.0.1-3.redhat_00004.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-validation-api 3.0.2-2.redhat_00005.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-ws-rs-api 3.1.0-4.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.0-4.redhat_00009.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jasypt 1.9.3-3.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-java-classmate 1.5.1-2.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-javaee-jpa-spec 3.1.0-3.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.2-4.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jberet +1 2.1.4-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jboss-cert-helper +1 1.1.2-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jboss-ejb-client 5.0.6-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jboss-modules 2.1.4-2.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jgroups 5.2.23-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jgroups-kubernetes 2.0.2-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-joda-time 2.12.5-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-jose4j 0.9.3-2.redhat_00004.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-log4j2-jboss-logmanager 1.1.2-1.Final_redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-lucene-core +6 8.11.3-1.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-narayana +8 6.0.2-1.Final_redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-netty +13 4.1.100-2.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-netty-transport-native-epoll 4.1.100-5.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-protostream 4.6.5-4.Final_redhat_00006.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-reactive-streams 1.0.4-2.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-resteasy +15 6.2.7-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.7-3.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-snakeyaml 2.0.0-2.redhat_00012.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.1-2.redhat_00008.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-sun-istack-commons +2 4.1.2-1.redhat_00003.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-2.redhat_00008.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.2-2.GA_redhat_00009.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.4-2.SP01_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wildfly-http-client +4 2.0.7-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wildfly-transaction-client 3.0.5-1.Final_redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-woodstox-core 6.4.0-2.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-ws-commons-XmlSchema 2.3.0-2.redhat_00002.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wsdl4j 1.6.3-4.redhat_00007.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.1-2.redhat_00014.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 8 eap8-yasson 3.0.3-2.redhat_00001.1.el8eap RHSA-2024:3581, RHSA-2024:3580
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.5.8-1.redhat_00001.1.el7eap RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559
Red Hat JBoss EAP 7 eap7-hal-console 3.3.22-1.Final_redhat_00001.1.el7eap RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559
Red Hat JBoss EAP 7 eap7-infinispan +9 11.0.19-2.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.54-3.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 3.0.0-8.SP08_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-jboss-metadata +5 13.5.0-1.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-jboss-modules 1.12.3-3.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-36.Final_redhat_00035.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-undertow 2.2.32-1.SP1_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-wildfly +5 7.4.17-2.GA_redhat_00002.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.2.4-1.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.23-2.Final_redhat_00001.1.el7eap RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.1.17-1.Final_redhat_00002.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.19-1.Final_redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-wss4j +6 2.4.3-1.redhat_00001.1.el8eap RHSA-2024:3561, RHSA-2024:3560
Red Hat JBoss EAP 7 eap7-xml-security 2.3.4-1.redhat_00002.1.el8eap RHSA-2024:3561, RHSA-2024:3560

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.security:wildfly-elytron-realm-token <= 2.4.0.CR1 — GHSA-v4mm-q8fv-r2w5

Advisories 8

References