PT-2015-4009 · Red Hat · Jboss Weld

Published 2015-02-13 · Updated 2020-06-10 · CVE-2014-8122

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JBoss Weld versions prior to 2.2.8 JBoss Weld versions 3.x prior to 3.0.0 Alpha3

Description A race condition exists, allowing remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

Recommendations For versions prior to 2.2.8, update to version 2.2.8 or later. For versions 3.x prior to 3.0.0 Alpha3, update to version 3.0.0 Alpha3 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2014-8122

GHSA-338V-3958-8V8R

RHSA-2015:0216

RHSA-2015:0217

RHSA-2015:0218

Affected Products

Jboss Weld

References · 19

• 🔥 https://github.com/victims/victims-cve-db/blob/master/database/java/2014/8122.yaml · Exploit
• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0773.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8122 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0216.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0218.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0215.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-338v-3958-8v8r · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0217.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0920.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0675.html · Vendor Advisory
• https://github.com/weld/core · Note
• https://github.com/weld/core/commit/8e413202fa1af08c09c580f444e4fd16874f9c65 · Note
• https://github.com/weld/core/commit/6808b11cd6d97c71a2eed754ed4f955acd789086 · Note