CVE-2022-2764

A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LASTCHUNK forever for EJB invocations...

CVE-2022-2764

A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LASTCHUNK from the bytes, causing a denial of service...

Denial Of Service (DoS)

eap7 is vulnerable to denail of service. The vulnerability exists due to a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal...

wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled

A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have...

org.wildfly:wildfly-batch (>=9.0.0.beta1, <=9.0.0.cr1), org.wildfly:wildfly-batch-parent (>=9.0.0.beta1, <=9.0.0.cr1) +21 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.0.3.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-batch =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1,...

org.wildfly:wildfly-ee (8.0.0.alpha1), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha1) +8 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.21.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.21.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha1 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha1 -...

br.eti.clairton:ds-test (0.4.0), com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (>=1.0.1, <=1.2.1) +52 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.0.0.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - br.eti.clairton:ds-test 0.4.0 - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service...

com.logitags:cibet-integrationtest (>=2.2, <=2.2.2), org.fakereplace:fakereplace-wildfly-tests (1.0.0.alpha3) +25 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.1.1.final)

org.jboss:jboss-ejb-client MAVEN version 2.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - com.logitags:cibet-integrationtest =2.2, =8.0.0.beta2, =8.0.0.beta1, =8.0.0.beta2, =9.0.0.cr2,...

org.jboss.ws.cxf:jbossws-cxf-test-utils (>=5.1.6.final, <=5.3.0.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (3.0.0.beta3)

org.jboss:jboss-ejb-client MAVEN version 3.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.ws.cxf:jbossws-cxf-test-utils =5.1.6.final, =5.3.0.final Source cves: CVE-2021-20250 Source...

ch.inftec.ju:ju-util-ee (>=4.1, <=4.2), com.github.marschall:osgi-remoting-ejb-jboss (0.2.0) +7 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.16.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.16.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-util-ee =4.1, =3.0.39, =3.0.39, =3.0.53, =3.0.53, =7.1.83 Source cves: CVE-2021-2025...

org.wildfly:wildfly-client-all (9.0.0.alpha1), org.wildfly:wildfly-clustering-ejb-spi (>=8.1.0.cr1, <=9.0.0.alpha1) +2 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.0.1.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-client-all 9.0.0.alpha1 - org.wildfly:wildfly-clustering-ejb-spi =8.1.0.cr1,...

org.infinispan.server:infinispan-server-commons (>=8.1.0.alpha1, <=8.1.0.alpha2), org.infinispan.server:infinispan-server-infinispan (>=8.1.0.alpha1, <=8.1.0.alpha2) +26 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.1.2.final)

org.jboss:jboss-ejb-client MAVEN version 2.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.infinispan.server:infinispan-server-commons =8.1.0.alpha1, =8.1.0.alpha1, =8.1.0.alpha1,...

org.jboss:jboss-remote-naming (1.0.0.beta4) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.0.beta12)

org.jboss:jboss-ejb-client MAVEN version 1.0.0.beta12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss:jboss-remote-naming 1.0.0.beta4 Source cves: CVE-2021-20250 Source advisory:...

ch.inftec.ju:ju-testing-ee (>=4.1, <=4.2), org.jboss:jboss-remote-naming (>=1.0.0.final, <=1.0.5.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.0.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.1, =1.0.0.final, =1.0.5.final Source cves: CVE-2021-20250 Source...

org.jboss.as:jboss-as-ejb-client-bom (7.1.0.final), org.jboss.as:jboss-as-jms-client-bom (7.1.0.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.2.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.0.final - org.jboss.as:jboss-as-jms-client-bom 7.1.0.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.3.final), org.jboss.as:jboss-as-jms-client-bom (7.1.3.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.11.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.3.final - org.jboss.as:jboss-as-jms-client-bom 7.1.3.final...

org.fakereplace:fakereplace-wildfly-tests (>=1.0.0.alpha6, <=1.0.0.alpha7), org.wildfly.bom:ejb-client-bom (>=13.0.0.alpha1, <=13.0.0.final) +5 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (>=4.0.0.beta16, <=4.0.37.final)

org.jboss:jboss-ejb-client MAVEN version =4.0.0.beta16, =1.0.0.alpha6, =13.0.0.alpha1, =1.0.0.alpha2, =11.0.0.alpha1, =11.0.0.alpha1, =11.0.0.alpha1, =11.0.0.alpha1, =22.0.1.final Source cves: CVE-2021-20250 Source advisory: OSV:GHSA-2259-H742-5VR4...

ch.inftec.ju:ju-testing-ee (>=4.4-4, <=4.5.1-11), ch.inftec.ju:ju-util-ee (>=4.4-4, <=4.5.1-11) +6 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.5.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.4-4, =4.4-4, =0.2.4, =0.2.9, =0.3.0 Source cves: CVE-2021-20250 Source...

org.javafxdata:datafx-ejb-wildfly (8.0b1), org.javafxdata:datafx-samples (8.0b1) +25 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.0.0.beta5)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.javafxdata:datafx-ejb-wildfly 8.0b1 - org.javafxdata:datafx-samples 8.0b1 -...

GHSA-2259-H742-5VR4 JBoss EJB Client information disclosure vulnerability

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality...