Vulnerabilities (CVE)

Filtered by vendor Redhat Subscribe
Filtered by product Jboss Fuse
Total 36 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-4104 3 Apache, Fedoraproject, Redhat 20 Log4j, Fedora, Codeready Studio and 17 more 2022-01-18 6.0 MEDIUM 7.5 HIGH
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2020-14307 1 Redhat 5 Amq, Jboss Enterprise Application Platform Continuous Delivery, Jboss Fuse and 2 more 2021-11-04 4.0 MEDIUM 6.5 MEDIUM
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
CVE-2019-14887 1 Redhat 6 Jboss Data Grid, Jboss Enterprise Application Platform, Jboss Fuse and 3 more 2021-11-02 6.4 MEDIUM 9.1 CRITICAL
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
CVE-2019-14820 1 Redhat 4 Jboss Enterprise Application Platform, Jboss Fuse, Keycloak and 1 more 2021-10-29 4.0 MEDIUM 4.3 MEDIUM
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
CVE-2021-3642 2 Quarkus, Redhat 13 Quarkus, Build Of Quarkus, Codeready Studio and 10 more 2021-10-20 3.5 LOW 5.3 MEDIUM
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
CVE-2020-1714 2 Quarkus, Redhat 7 Quarkus, Decision Manager, Jboss Fuse and 4 more 2021-10-19 6.5 MEDIUM 8.8 HIGH
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
CVE-2020-25644 2 Netapp, Redhat 10 Oncommand Insight, Oncommand Workflow Automation, Service Level Manager and 7 more 2021-10-19 5.0 MEDIUM 7.5 HIGH
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
CVE-2020-25689 2 Netapp, Redhat 10 Active Iq Unified Manager, Oncommand Insight, Service Level Manager and 7 more 2021-10-19 6.8 MEDIUM 6.5 MEDIUM
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
CVE-2019-10172 4 Apache, Debian, Fasterxml and 1 more 5 Spark, Debian Linux, Jackson-mapper-asl and 2 more 2021-09-27 5.0 MEDIUM 7.5 HIGH
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
CVE-2020-14340 1 Redhat 8 Jboss Brms, Jboss Data Grid, Jboss Data Virtualization and 5 more 2021-06-14 4.3 MEDIUM 5.9 MEDIUM
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
CVE-2021-20218 1 Redhat 9 A-mq Online, Build Of Quarkus, Codeready Studio and 6 more 2021-03-25 5.8 MEDIUM 7.4 HIGH
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
CVE-2020-27782 1 Redhat 3 Jboss Fuse, Openshift Application Runtimes, Undertow 2021-02-27 7.8 HIGH 7.5 HIGH
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
CVE-2020-10734 1 Redhat 4 Jboss Fuse, Keycloak, Openshift Application Runtimes and 1 more 2021-02-26 2.1 LOW 3.3 LOW
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
CVE-2020-1717 1 Redhat 4 Jboss Fuse, Keycloak, Openshift Application Runtimes and 1 more 2021-02-17 4.0 MEDIUM 2.7 LOW
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
CVE-2020-10714 1 Redhat 5 Codeready Studio, Descision Manager, Jboss Fuse and 2 more 2020-12-23 5.1 MEDIUM 7.5 HIGH
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2013-7398 2 Async-http-client Project, Redhat 2 Async-http-client, Jboss Fuse 2020-12-16 4.3 MEDIUM N/A
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
CVE-2013-7397 2 Async-http-client Project, Redhat 2 Async-http-client, Jboss Fuse 2020-12-16 4.3 MEDIUM N/A
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
CVE-2020-10718 1 Redhat 2 Jboss Fuse, Wildfly 2020-09-22 5.0 MEDIUM 7.5 HIGH
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
CVE-2019-14892 2 Fasterxml, Redhat 7 Jackson-databind, Decision Manager, Jboss Data Grid and 4 more 2020-09-04 7.5 HIGH 9.8 CRITICAL
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVE-2020-14297 1 Redhat 5 Amq, Jboss Enterprise Application Platform Continuous Delivery, Jboss Fuse and 2 more 2020-07-29 4.0 MEDIUM 6.5 MEDIUM
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.