PT-2015-4009 · Red Hat · Jboss Weld

Publicado 2015-02-13 · Atualizado 2020-06-10 · CVE-2014-8122

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Weld versions prior to 2.2.8 JBoss Weld versions 3.x prior to 3.0.0 Alpha3

Description A race condition exists, allowing remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

Recommendations For versions prior to 2.2.8, update to version 2.2.8 or later. For versions 3.x prior to 3.0.0 Alpha3, update to version 3.0.0 Alpha3 or later.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2014-8122

GHSA-338V-3958-8V8R

RHSA-2015:0216

RHSA-2015:0217

RHSA-2015:0218

Produtos afetados

Jboss Weld

Referências · 19

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/8122.yaml · Exploit
• https://github.com/weld/core · Nota
• https://github.com/weld/core/commit/8e413202fa1af08c09c580f444e4fd16874f9c65 · Nota
• https://github.com/weld/core/commit/6808b11cd6d97c71a2eed754ed4f955acd789086 · Nota
• https://github.com/weld/core/commit/29fd1107fd30579ad9bb23fae4dc3ba464205745 · Nota
• http://securitytracker.com/id/1031741 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0773.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-8122 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2015-0216.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100892 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0218.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0215.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-338v-3958-8v8r · Aviso do Fabricante