Eap: wildfly-elytron has a ssrf security issue
Priority MEDIUM 40CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 9 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00847 58th percentileScored 2026-11-07
Fix Partial wildfly: 32.0.0.FinalRed Hat: 9 advisoriesRed Hat: 9 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | wildfly | before 32.0.0.Final | 32.0.0.Final | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | 1.15.23.Final-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 3.0.1-4.b08_redhat_00005.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 5.1.17-3.Final_redhat_00004.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 4.0.12-1.Final_redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 4.1.63-2.Final_redhat_00003.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.4.18-16.SP14_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 7.1.11-4.GA_redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.1.14-1.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.0.21-1.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.0.13-1.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.0.12-1.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.0.12-6.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-5.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-5.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-2.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.7.2-16.Final_redhat_00017.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 4.1.63-5.Final_redhat_00003.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.0.41-4.SP5_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 7.3.14-3.GA_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.10.17-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.5.8-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.3.22-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 11.0.19-2.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 4.0.54-3.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.0.0-8.SP08_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 13.5.0-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.12.3-3.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.10.0-36.Final_redhat_00035.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.32-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.17-2.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.2.4-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.15.23-2.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.1.17-1.Final_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.1.19-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.4.3-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.3.4-1.redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.5.8-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.3.22-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 11.0.19-2.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 4.0.54-3.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.0.0-8.SP08_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 13.5.0-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.12.3-3.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.10.0-36.Final_redhat_00035.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.32-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.17-2.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.2.4-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.15.23-2.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.1.17-1.Final_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.1.19-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.4.3-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.3.4-1.redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.15.23-2.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 4.0.1-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.2.4-2.SP01_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 4.0.1-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.2.4-2.SP01_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| — | org.wildfly.security:wildfly-elytron-realm-token (Maven) | up to 2.4.0.CR1 | — | No fix listed | GHSA-v4mm-q8fv-r2w5 |
- wildfly Vendor— Affected before 32.0.0.Final Fixed in 32.0.0.Final Patch available CNA
- Red Hat JBoss Enterprise Application Platform VendorRed Hat Affected — Fixed in 1.15.23.Final-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 3.0.1-4.b08_redhat_00005.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 5.1.17-3.Final_redhat_00004.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.0.12-1.Final_redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-2.Final_redhat_00003.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.4.18-16.SP14_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.1.11-4.GA_redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.1.14-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.21-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.13-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.12-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.12-6.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-2.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.7.2-16.Final_redhat_00017.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-5.Final_redhat_00003.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-4.SP5_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.14-3.GA_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.10.17-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.5.8-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.3.22-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 11.0.19-2.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.54-3.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.0.0-8.SP08_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 13.5.0-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.12.3-3.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.10.0-36.Final_redhat_00035.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.32-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.17-2.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.2.4-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.15.23-2.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.1.17-1.Final_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.1.19-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.4.3-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.4-1.redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.5.8-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.3.22-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 11.0.19-2.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.54-3.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.0.0-8.SP08_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 13.5.0-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.12.3-3.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.10.0-36.Final_redhat_00035.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.32-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.17-2.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.2.4-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.15.23-2.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.1.17-1.Final_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.1.19-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.4.3-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.4-1.redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.15.23-2.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.1-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.4-2.SP01_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.1-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.4-2.SP01_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.wildfly.security:wildfly-elytron-realm-token (Maven) Vendor— Affected up to 2.4.0.CR1 Fixed in — No fix listed GHSA-v4mm-q8fv-r2w5
CPE names CNA · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7 | 7.1 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7 | 7.3 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7 Versions 7.1 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7 Versions 7.3 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
Remediation
- Fix · CNA wildfly Fixed in 32.0.0.Final
Red Hat 9 advisories
- RHSA-2025:9582 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
- RHSA-2025:9583 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
- RHSA-2024:3580 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el8eap +47
Show 6 more Red Hat advisories
- RHSA-2024:3581 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el9eap +47
- RHSA-2024:3583 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss Enterprise Application Platform 8
- RHSA-2024:3563 Released 2024-06-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss Enterprise Application Platform org.apache.cxf.cxf-core-3.5.8.redhat-00001.jar, org.jboss.hal.hal-console-3.3.22.Final-redhat-00001-resources.jar, org.wildfly.security.wildfly-elytron-1.15.23.Final-redhat-00001.jar
- RHSA-2024:3560 Released 2024-06-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf-3.5.8-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el8eap +47
- RHSA-2024:3561 Released 2024-06-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf-3.5.8-1.redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el9eap +47
- RHSA-2024:3559 Released 2024-06-03 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf-3.5.8-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el7eap +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:3559 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:3560 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:3561 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:3580 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:3581 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2024:3563 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:9582 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:9583 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:3583 |
Not affected: 4 products
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 8.0 for RHEL 8
- Red Hat JBoss EAP 8.0 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1233
- 2026-10-03 Alias added: GHSA-v4mm-q8fv-r2w5
- 2026-10-25 Priority changed: LOW → MEDIUM
References
Advisory 10
Other 7
- https://access.redhat.com/security/cve/CVE-2024-1233
- RHBZ#2262849
- https://github.com/advisories/GHSA-v4mm-q8fv-r2w5
- https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523
- https://issues.redhat.com/browse/WFLY-19226
- https://github.com/wildfly/wildfly/commit/aa151a00d75d6dbc4a1bf1b68d58b9de3087bb62
- https://github.com/wildfly-security/wildfly-elytron
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-1233 · CVE Program
- CVE-2024-1233 · NVD
- FIRST EPSS
- GHSA-v4mm-q8fv-r2w5 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1233 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences