PT-2019-5653 · Red Hat · Wildfly
Laura Pardo
·
Published
2019-04-30
·
Updated
2020-10-15
·
CVE-2019-3894
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WildFly versions 11 through 16
Description
The issue is related to security checking implementation errors for standard elements in the Java application server. It may allow a remote attacker to impact the confidentiality and integrity of protected information. Specifically, the ElytronManagedThread in Wildfly's Elytron subsystem stores a SecurityIdentity to run the thread as, and these threads may not terminate even after the keep alive time has expired, potentially allowing a shared thread to use the wrong security identity when executing.
Recommendations
For WildFly versions 11 through 16, consider restricting access to the Elytron subsystem until a patch is available.
As a temporary workaround, consider disabling the use of shared threads in the Elytron subsystem to minimize the risk of exploitation.
Avoid using the ElytronManagedThread function in the affected Wildfly versions until the issue is resolved.
Fix
Improperly Implemented Security Check for Standard
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wildfly