Read the docs
TI-2013-01806 Aliases CVE-2013-2035GHSA-49j7-qghp-5wj8

Race condition in…

Priority LOW 21CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 16 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

Why it matters now

EPSS 0.00589 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.fusesource.hawtjni:hawtjni-runtime (Maven): 1.8Red Hat: 14 advisoriesRed Hat: 16 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.fusesource.hawtjni:hawtjni-runtime (Maven)before 1.81.8Patch availableGHSA-49j7-qghp-5wj8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.fusesource.hawtjni:hawtjni-runtime (Maven) Vendor— Affected before 1.8 Fixed in 1.8 Patch available GHSA-49j7-qghp-5wj8

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:redhat:hawtjni:*:*:*:*:*:*:*:*up to 1.7VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.1:*:*:*:*:*:*:*1.1VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.2:*:*:*:*:*:*:*1.2VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.3:*:*:*:*:*:*:*1.3VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.4:*:*:*:*:*:*:*1.4VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.5:*:*:*:*:*:*:*1.5VulnerableRed Hat
cpe:2.3:a:redhat:hawtjni:1.6:*:*:*:*:*:*:*1.6VulnerableRed Hat
  • cpe:2.3:a:redhat:hawtjni:*:*:*:*:*:*:*:* Versions up to 1.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:hawtjni:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-49j7-qghp-5wj8 org.fusesource.hawtjni:hawtjni-runtime (Maven) Fixed in 1.8 Advisory →

Red Hat 14 advisories

  • RHSA-2015:0034 Released 2015-01-12 · Red Hat rating Moderate
    Red Hat JBoss Data Virtualization 6.0.0 security update
    • Red Hat JBoss Data Virtualization 6.0
  • RHSA-2014:1995 Released 2014-12-15 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2014:1904 Released 2014-11-25 · Red Hat rating Important
    Red Hat JBoss Operations Network 3.3.0 update
    • Red Hat JBoss Operations Network 3.3
Show 11 more Red Hat advisories
  • RHSA-2014:1290 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1291 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1
  • RHSA-2014:0254 Released 2014-03-05 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 1.2 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • Red Hat OpenShift Enterprise Node activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0245 Released 2014-03-03 · Red Hat rating Important
    activemq security update
    • RHOSE Infrastructure 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
    • RHOSE Node 2.0 activemq-5.9.0-4.redhat.610328.el6op, activemq-client-5.9.0-4.redhat.610328.el6op
  • RHSA-2014:0029 Released 2014-01-15 · Red Hat rating Important
    Red Hat JBoss Data Grid 6.2.0 update
    • Red Hat JBoss Data Grid 6.2
  • RHSA-2013:1786 Released 2013-12-04 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 6.2.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el6, apache-commons-beanutils-1.8.3-13.redhat_6.1.ep6.el6, apache-commons-cli-1.2-8.redhat_3.1.ep6.el6 +47
  • RHSA-2013:1785 Released 2013-12-04 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 6.2.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server antlr-eap6-2.7.7-17.redhat_4.1.ep6.el5, apache-commons-beanutils-1.8.3-13.redhat_6.1.ep6.el5, apache-commons-cli-1.2-8.redhat_3.1.ep6.el5 +47
  • RHSA-2013:1784 Released 2013-12-04 · Red Hat rating Low
    Red Hat JBoss Enterprise Application Platform 6.2.0 update
    • Red Hat JBoss Enterprise Application Platform 6.2
  • RHSA-2013:1029 Released 2013-07-09 · Red Hat rating Important
    Fuse MQ Enterprise 7.1.0 update
    • Fuse MQ Enterprise 7.1.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 6AffectedNo fix yet
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Fuse MQ Enterprise 7.1.0Fixed RHSA-2013:1029
RHOSE Infrastructure 1.2Fixed RHSA-2014:0254
RHOSE Infrastructure 2.0Fixed RHSA-2014:0245
RHOSE Node 2.0Fixed RHSA-2014:0245
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:1291
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:1290
Red Hat JBoss Data Grid 6.2Fixed RHSA-2014:0029
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2015:0034
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2013:1785
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2013:1786
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2013:1784
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:1995
Red Hat JBoss Operations Network 3.3Fixed RHSA-2014:1904
Red Hat OpenShift Enterprise NodeFixed RHSA-2014:0254

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2035
  2. 2026-10-03 Alias added: GHSA-49j7-qghp-5wj8

References

Exploit 1

Advisory 10

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences