<html>
<head>
<base href="https://bugzilla.rosalinux.ru/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Platform</th>
<td>2021.1
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_CONFIRMED "
title="CONFIRMED - [CVE 21] wildfly 10.1.0 CVEs found"
href="https://bugzilla.rosalinux.ru/show_bug.cgi?id=13342">13342</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[CVE 21] wildfly 10.1.0 CVEs found
</td>
</tr>
<tr>
<th>Classification</th>
<td>ROSA-based products
</td>
</tr>
<tr>
<th>Product</th>
<td>ROSA Fresh
</td>
</tr>
<tr>
<th>Version</th>
<td>All
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>URL</th>
<td>CVE-2018-14627, CVE-2020-10718, CVE-2020-10740, CVE-2020-1719, CVE-2020-25640, CVE-2021-3503, CVE-2021-3536, CVE-2022-1278,
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>CONFIRMED
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>Normal
</td>
</tr>
<tr>
<th>Component</th>
<td>System (kernel, glibc, systemd, bash, PAM...)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>Reporter</th>
<td>y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>bugs@lists.rosalinux.ru
</td>
</tr>
<tr>
<th>CC</th>
<td>s.matveev@rosalinux.ru, y.tumanov@rosalinux.ru
</td>
</tr>
<tr>
<th>Target Milestone</th>
<td>---
</td>
</tr>
<tr>
<th>Flags</th>
<td>secteam_verified?
</td>
</tr></table>
<p>
<div>
<pre>Please patch CVEs for package wildfly version 10.1.0
INFO (CVEs are): wildfly 10.1.0
cves found
CVE-2018-14627
Desc: The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not
honour configuration when SSL transport is required. Servers before this
version that are configured with the following setting allow clients to create
plaintext connections: <transport-config confidentiality="required"
trust-in-target="supported"/>
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-14627">https://nvd.nist.gov/vuln/detail/CVE-2018-14627</a>
Severity: MEDIUM
CVE-2020-10718
Desc: A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where
the embedded managed process API has an exposed setting of the Thread Context
Classloader (TCCL). This setting is exposed as a public method, which can
bypass the security manager. The highest threat from this vulnerability is to
confidentiality.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-10718">https://nvd.nist.gov/vuln/detail/CVE-2020-10718</a>
Severity: HIGH
CVE-2020-10740
Desc: A vulnerability was found in Wildfly in versions before 20.0.0.Final,
where a remote deserialization attack is possible in the Enterprise Application
Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-10740">https://nvd.nist.gov/vuln/detail/CVE-2020-10740</a>
Severity: HIGH
CVE-2020-1719
Desc: A flaw was found in wildfly. The EJBContext principle is not popped back
after invoking another EJB using a different Security Domain. The highest
threat from this vulnerability is to data confidentiality and integrity.
Versions before wildfly 20.0.0.Final are affected.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-1719">https://nvd.nist.gov/vuln/detail/CVE-2020-1719</a>
Severity: MEDIUM
CVE-2020-25640
Desc: A flaw was discovered in WildFly before 21.0.0.Final where, Resource
adapter logs plain text JMS password at warning level on connection error,
inserting sensitive information in the log file.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-25640">https://nvd.nist.gov/vuln/detail/CVE-2020-25640</a>
Severity: MEDIUM
CVE-2021-3503
Desc: A flaw was found in Wildfly where insufficient RBAC restrictions may lead
to expose metrics data. The highest threat from this vulnerability is to the
confidentiality.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-3503">https://nvd.nist.gov/vuln/detail/CVE-2021-3503</a>
Severity: MEDIUM
CVE-2021-3536
Desc: A flaw was found in Wildfly in versions before 23.0.2.Final while
creating a new role in domain mode via the admin console, it is possible to add
a payload in the name field, leading to XSS. This affects Confidentiality and
Integrity.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-3536">https://nvd.nist.gov/vuln/detail/CVE-2021-3536</a>
Severity: MEDIUM
CVE-2022-1278
Desc: A flaw was found in WildFly, where an attacker can see deployment names,
endpoints, and any other data the trace payload may contain.
Link: <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-1278">https://nvd.nist.gov/vuln/detail/CVE-2022-1278</a>
Severity: HIGH</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>