Description
An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.11.0-1.redhat_00001.1.el7eap | RHSA-2025:16668, RHSA-2025:16667 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hibernate-validator +1 | 5.3.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2025:16668 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hornetq +3 | 2.4.11-1.Final_redhat_00001.1.el7eap | RHSA-2025:16668, RHSA-2025:16667 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-19.Final_redhat_00020.1.el7eap | RHSA-2025:16667 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-17.SP15_redhat_00001.1.ep7.el7 | RHSA-2025:16668, RHSA-2025:16667 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.12-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:16668, RHSA-2025:16667 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.15-5.GA_redhat_00003.1.el7eap | RHSA-2025:16667 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.33.0-2.redhat_00016.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-angus-activation | 2.0.2-1.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-lang | 3.14.0-3.redhat_00007.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-atinject | 2.0.1-3.redhat_00006.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-azure-storage | 8.6.6-4.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-commons-logging-jboss-logging | 1.0.0-2.Final_redhat_1.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.5.0-1.GA_redhat_00001.1.el8eap | RHSA-2025:0371, RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-ecj | 1:3.31.0-2.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-expressly | 5.0.0-5.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-hal-console | 3.6.20-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.32-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-hornetq +3 | 2.4.10-1.Final_redhat_00001.1.el8eap | RHSA-2025:0371, RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jakarta-activation | 2.1.3-1.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jakarta-security +5 | 3.0.3-2.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jakarta-xml-bind-api | 4.0.2-1.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jansi | 1.18.0-2.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-javaee-security-soteria +1 | 3.0.0-3.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jboss-ejb-client | 5.0.8-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jboss-marshalling +1 | 2.1.6-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting | 5.0.30-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jboss-weld-api +2 | 5.0.0-4.SP3_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.3.0-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.5-1.redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-jgroups | 1:5.2.23-2.Final_redhat_00001.1.el8eap | RHSA-2025:0371 |
| Red Hat JBoss EAP 8 | eap8-jsonb-spec | 3.0.1-1.redhat_00002.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.4-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.114-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-parsson | 1.1.7-1.redhat_00002.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-resteasy +15 | 6.2.11-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.18-1.SP1_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-undertow-jastow | 2.2.8-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-vdx +2 | 1.1.6-3.redhat_1.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.5-3.GA_redhat_00002.1.el8eap | RHSA-2025:0371, RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.2.7-1.Final_redhat_00001.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 8 | eap8-yasson | 3.0.4-1.redhat_00002.1.el8eap | RHSA-2024:11560, RHSA-2024:11559 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.25-1.Final_redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.37-1.Final_redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-hornetq +3 | 2.4.11-1.Final_redhat_00001.1.el7eap | RHSA-2024:11529 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common | 3.4.0-1.Final_redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.14-1.Final_redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-opensaml +13 | 3.4.6-1.redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.21-2.GA_redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.21-2.GA_redhat_00001.1.el8eap | RHSA-2025:1638, RHSA-2025:1637 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.3.5-1.redhat_00001.1.el7eap | RHSA-2025:1638, RHSA-2025:1637, RHSA-2025:1636 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hornetq:hornetq-core-client | <= 2.4.9 | — | GHSA-r7mv-mv7m-pjw3 |
Advisories 11
- RHSA-2025:16668 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:16667 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1638 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:1637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:1636 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.21 security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:0371 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2024:11560 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.5 Security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2024:11529 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2024:11559 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.5 Security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-3736 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Sep 24, 2025