JBoss EJB Client information disclosure vulnerability

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality...

org.jboss.as:jboss-as-ejb-client-bom (7.1.2.final), org.jboss.as:jboss-as-jms-client-bom (7.1.2.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.10.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.2.final - org.jboss.as:jboss-as-jms-client-bom 7.1.2.final...

ch.inftec.ju:ju-ee (>=6.0-2, <=6.1-s-5), org.fakereplace:fakereplace-wildfly-tests (>=1.0.0.alpha4, <=1.0.0.alpha5) +49 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.1.4.final)

org.jboss:jboss-ejb-client MAVEN version 2.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-ee =6.0-2, =1.0.0.alpha4, =8.2.0.beta2, =8.2.0.beta2, =8.2.0.beta2, =1.0.0.beta5,...

org.infinispan.server:infinispan-server-commons (>=8.1.0.beta1, <=8.2.0.beta1), org.infinispan.server:infinispan-server-infinispan (>=8.1.0.beta1, <=8.2.0.beta1) +29 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.1.3.final)

org.jboss:jboss-ejb-client MAVEN version 2.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.infinispan.server:infinispan-server-commons =8.1.0.beta1, =8.1.0.beta1, =8.1.0.beta1, =10.0.0.cr4...

org.wildfly:wildfly-arquillian-common-domain (>=8.0.0.alpha3, <=8.0.0.beta1), org.wildfly:wildfly-arquillian-container-domain-managed (>=8.0.0.alpha3, <=8.0.0.beta1) +14 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (2.0.0.beta3)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-arquillian-common-domain =8.0.0.alpha3, =8.0.0.alpha3, =8.0.0.alpha3,...

org.wildfly:wildfly-ee (8.0.0.alpha2), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha2) +8 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.22.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.22.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha2 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha2 -...

org.fakereplace:fakereplace-wildfly-tests (>=1.0.0.alpha6, <=1.0.0.alpha7), org.wildfly.bom:ejb-client-bom (>=13.0.0.alpha1, <=13.0.0.final) +5 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (>=4.0.0.beta16, <=4.0.37.final)

org.jboss:jboss-ejb-client MAVEN version =4.0.0.beta16, =1.0.0.alpha6, =13.0.0.alpha1, =1.0.0.alpha2, =11.0.0.alpha1, =11.0.0.alpha1, =11.0.0.alpha1, =11.0.0.alpha1, =22.0.1.final Source cves: CVE-2021-20250 Source advisory: GHSA-2259-H742-5VR4...

org.jboss:jboss-remote-naming (>=1.0.6.final, <=2.0.0.beta2) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.13.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss:jboss-remote-naming =1.0.6.final, =2.0.0.beta2 Source cves: CVE-2021-20250 Source advisory...

org.jboss.as:jboss-as-ejb-client-bom (7.1.3.final), org.jboss.as:jboss-as-jms-client-bom (7.1.3.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.11.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.3.final - org.jboss.as:jboss-as-jms-client-bom 7.1.3.final...

Wildfly EJB Client causes DoS

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventually unavailable. An attacker can take advantage and cause denial of service attack and ma...

GHSA-QCCH-9268-59JW Wildfly EJB Client causes DoS

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventually unavailable. An attacker can take advantage and cause denial of service attack and ma...

org.wildfly:wildfly-ee (8.0.0.alpha1), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha1) +8 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.21.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.21.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha1 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha1 -...

org.wildfly:wildfly-ee (8.0.0.alpha2), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha2) +8 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.22.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.22.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha2 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha2 -...

org.wildfly:wildfly-arquillian-common-domain (>=8.0.0.alpha3, <=8.0.0.beta1), org.wildfly:wildfly-arquillian-container-domain-managed (>=8.0.0.alpha3, <=8.0.0.beta1) +14 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.0.0.beta3)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-arquillian-common-domain =8.0.0.alpha3, =8.0.0.alpha3, =8.0.0.alpha3,...

org.javafxdata:datafx-ejb-wildfly (8.0b1), org.javafxdata:datafx-samples (8.0b1) +25 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.0.0.beta5)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.javafxdata:datafx-ejb-wildfly 8.0b1 - org.javafxdata:datafx-samples 8.0b1 -...

ch.inftec.ju:ju-testing-ee (>=4.4-4, <=4.5.1-11), ch.inftec.ju:ju-util-ee (>=4.4-4, <=4.5.1-11) +6 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.5.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-testing-ee =4.4-4, =4.4-4, =0.2.4, =0.2.9, =0.3.0 Source cves: CVE-2020-14297 Source...

org.jboss:jboss-remote-naming (>=1.0.6.final, <=2.0.0.beta2) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.13.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss:jboss-remote-naming =1.0.6.final, =2.0.0.beta2 Source cves: CVE-2020-14297 Source advisory...

br.eti.clairton:ds-test (0.4.0), com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (>=1.0.1, <=1.2.1) +52 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.0.0.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - br.eti.clairton:ds-test 0.4.0 - com.bertoncelj.wildflysingletonservice:wildfly-singleton-service...

org.wildfly:wildfly-batch (>=9.0.0.beta1, <=9.0.0.cr1), org.wildfly:wildfly-batch-parent (>=9.0.0.beta1, <=9.0.0.cr1) +21 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.0.3.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-batch =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1, =9.0.0.beta1,...

ch.inftec.ju:ju-ee (>=6.0-2, <=6.1-s-5), org.fakereplace:fakereplace-wildfly-tests (>=1.0.0.alpha4, <=1.0.0.alpha5) +49 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.1.4.final)

org.jboss:jboss-ejb-client MAVEN version 2.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-ee =6.0-2, =1.0.0.alpha4, =8.2.0.beta2, =8.2.0.beta2, =8.2.0.beta2, =1.0.0.beta5,...